Implement the setns syscall

This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.

Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
  the files in this directory to somewhere else in the filesystem keeps the
  corresponding namespace alive even if all processes currently in
  the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
  by a file descriptor.

PiperOrigin-RevId: 550694515

pkg/sentry/socket/netstack/netstack.go

@@ -442,7 +442,7 @@ func (s *sock) Release(ctx context.Context) {
 			_ = t.BlockWithDeadline(ch, true, deadline)
 		}
 	}
-	s.namespace.DecRef()
+	s.namespace.DecRef(ctx)
 }
 
 // Epollable implements FileDescriptionImpl.Epollable.