cgroupfs: Set initial cgroup ownership based on initial app uid/gid.
cgroupfs: Set initial cgroup ownership based on initial app uid/gid.

When the init task is specifically placed into some initial cgroup,
sandbox users expect to be able to create cgroupfs dirs as the app
uid/gid.

Previously we default the synthetic directories for the initial cgroup
to 0555, which disallows arbitrary users from creating children.

Add a way to specify the ownership and permissions for the initial
cgroup, and sandbox uses can use these to make the initial cgroup dir
writable by the init task's user.

PiperOrigin-RevId: 447614804

google/gvisor,google/gvisor,google/gvisor,google/gvisor,google/gvisor,google/gvisor,google/gvisor,google/gvisor