stage1: split out procfs restrictions logic
stage1: split out procfs restrictions logic

`appToSystemd()` is already quite large and will keep growing when adding new
procfs restrictions. This commit refactors filtering logic in its own function.
Ref #2616

joshix/rkt,cab105/rkt,shobhit85/rkt,jjlakis/rkt,jjlakis/rkt,Shashwatsh/rkt,shobhit85/rkt,monstermunchkin/rkt,jjlakis/rkt,Shashwatsh/rkt,lucasallan/rkt,shobhit85/rkt,yifan-gu/rkt,jakon89/rkt,rkt/rkt,euank/rkt,matthaias/rkt,lucasallan/rkt,sstabellini/rkt,rkt/rkt,sgotti/rkt,yifan-gu/rocket,achanda/rkt,achanda/rkt,ybubnov/rkt,akshaykarle/rkt,tmrts/rkt,monstermunchkin/rkt,kinvolk/rkt,sgotti/rkt,intelsdi-x/rkt,akshaykarle/rkt,kinvolk/rkt,jakon89/rkt,intelsdi-x/rkt,ybubnov/rkt,squeed/rkt,rkt/rkt,yifan-gu/rocket,alban/rkt,dgonyeo/rkt,nhlfr/rkt,squeed/rkt,joshix/rkt,cab105/rkt,Shashwatsh/rkt,yifan-gu/rkt,Wilybald/rkt,s-urbaniak/rkt,matthaias/rkt,sgotti/rkt,mike1729/rkt,ybubnov/rkt,jakon89/rkt,matthaias/rkt,jonboulle/rkt,yifan-gu/rocket,tmrts/rkt,kinvolk/rkt,intelsdi-x/rkt,jonboulle/rkt,s-urbaniak/rkt,euank/rkt,joshix/rkt,mike1729/rkt,dgonyeo/rkt,squeed/rkt,coreos/rkt,Wilybald/rkt,Wilybald/rkt,mike1729/rkt,akshaykarle/rkt,rkt/rkt,lucasallan/rkt,alban/rkt,cab105/rkt,coreos/rkt,joshix/rkt,kinvolk/rkt,lucasallan/rkt,sstabellini/rkt,euank/rkt,dgonyeo/rkt,jonboulle/rkt,tmrts/rkt,achanda/rkt,nhlfr/rkt,alban/rkt,coreos/rkt,monstermunchkin/rkt,sstabellini/rkt,nhlfr/rkt,yifan-gu/rkt,Wilybald/rkt,s-urbaniak/rkt