cgroups: v2 disable unused controllers

[shoenig]

Given the "inverted" nature of cgroups v1 & v2, one could describe v1 as "opt-in" controllers and v2 as "opt-out" controllers. When we added support for v2 did not consider that processes being added to Nomad's task cgroups would be having all controllers activated - including ones that were never being used before like rdma, misc, etc. These may have unwanted side affects.

Nomad should set cgroup.subtree_controll on Nomad's parent cgroup (e.g. nomad.slice) so that only cpu, memory, and cpuset controllers are activated on the per-task cgroups.

Note: we need to be careful to only activate/de-activate controllers actually present in cgroup.controllers (which will vary per-system) - otherwise the kernel will fail the underlying syscall.

e.g.

err = os.WriteFile(subtree, []byte("+cpu +cpuset +memory -pids -io -hugetlb -rdma -misc"), 0o644)

[shoenig]

As of #18371 we ensure the correct cgroup controllers are enabled.