rootless: fix running with /proc/self/setgroups set to deny
rootless: fix running with /proc/self/setgroups set to deny

This is a regression from 06f789cf26774dd64cb2a9cc0b3c6a6ff832733b
when the user namespace was configured without a privileged helper.
To allow a single mapping in an user namespace, it is necessary to set
/proc/self/setgroups to "deny".

For a simple reproducer, the user namespace can be created with
"unshare -r".

Signed-off-by: Giuseppe Scrivano <20002b7b24c75512093a71a58285826d5c504fca@redhat.com>

mYmNeo/runc,mYmNeo/runc,justincormack/runc,opencontainers/runc,rhatdan/runc,kolyshkin/runc,mheon/runc,estesp/runc,adrianreber/runc,mikebrow/runc,dqminh/runc,rhatdan/runc,mikebrow/runc,laijs/runc,dqminh/runc,adrianreber/runc,opencontainers/runc,justincormack/runc,estesp/runc,xiaochenshen/runc,xiaochenshen/runc,opencontainers/runc,estesp/runc,crosbymichael/runc,dqminh/runc,mheon/runc,laijs/runc,kolyshkin/runc,laijs/runc,crosbymichael/runc,crosbymichael/runc,dqminh/runc,mheon/runc,mikebrow/runc,kolyshkin/runc,rhatdan/runc,justincormack/runc,kolyshkin/runc,adrianreber/runc,xiaochenshen/runc,opencontainers/runc,rhatdan/runc,mYmNeo/runc