rootlessnetns: do not pool the unshared thread

[vtushar06]

setupMounts unshares the mount namespace, but ns.Do() saves and restores only the net namespace and then unlocks the thread, so it goes back to the go scheduler still inside that namespace and later goroutines can run there with the wrong /run.

Do() already handles this case for its own failure path, its comment says to leave the thread locked to die. Taking a second lock here means its unlock leaves the count at one, so the runtime scraps the thread when the goroutine ends instead of pooling it.

Checked how often a pooled thread actually gets picked up again, by locking a thread, unsharing CLONE_NEWNS, unlocking, then reading /proc/thread-self/ns/mnt from 2000 goroutines:

1 leaked thread     87 of 2000 goroutines landed on it   4.4%
11 leaked threads   1451 of 2000                         72.5%

I have not tied it to a user visible bug, / is MS_SLAVE so /usr and /etc stay right and only /run is wrong in there.

Fixes: #1109