support --privileged --cgroupns=private on cgroup v1

[AkihiroSuda]

Description
--privileged --cgroupns=private on cgroup v1 should be supported.

Steps to reproduce the issue:

$ docker run --rm --privileged --cgroupns=private hello-world

Describe the results you received:

docker: Error response from daemon: privileged mode is incompatible with private cgroup namespaces on cgroup v1 host.  You must run the container in the host cgroup namespace when running privileged mode.
See 'docker run --help'.

Describe the results you expected:
It should work

Additional information you deem important (e.g. issue happens only occasionally):

Not sure why we didn't support --privileged --cgroupns=private on cgroup v1.
Couldn't figure out in #38377

Output of docker version:

Client:
 Version:           20.03.0-dev
 API version:       1.41
 Go version:        go1.13.9
 Git commit:        2f494e118
 Built:             Tue Apr  7 14:28:04 2020
 OS/Arch:           linux/amd64
 Experimental:      true

Server:
 Engine:
  Version:          dev
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.9
  Git commit:       a6a47d1a49
  Built:            Tue Apr  7 14:26:17 2020
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.3.0-468-g4660e4db
  GitCommit:        4660e4dbb653b4d83ffbc7b0dd21c9c2d2f10ea3
 runc:
  Version:          1.0.0-rc10+dev
  GitCommit:        d3fdacb92f4e82b4916900483d6a94caa3869041
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

[AkihiroSuda]

cc @rgulewich @giuseppe

[thaJeztah]

/cc @kolyshkin

[AkihiroSuda]

@rgulewich WDYT?

[AkihiroSuda]

PR: #40845

[rgulewich]

@AkihiroSuda - When I originally implemented this, I had thought that a privileged container also meant having access to the host namespaces. If I'm understanding your comment here, the "correct" behaviour is for privileged containers to still get their own private namespaces, unless they explicitly request host namespaces? If that's the case, then this makes sense to me (and your PR seems reasonable).

[AkihiroSuda]

The default behavior is unchanged