systemd-nspawn, and probably other container runtimes, can sometimes mount a cgroupsv1 hierarchy in a cgroup namespace. This ends up infecting the host system, so we optionally allow that. We still will error out if we happen to be the one running in a legacy cgroupsv1 controller hierarchy, however. We still depend on unified/cgroupsv2.