Remove all child cgroups before removing parents

[jb3]

After #91 was merged we starting seeing errors with large stdout causing errors like the following:

2021-02-26 16:02:56,706 |    14 |                 snekbox.nsjail |     INFO | Executing code...
2021-02-26 16:02:56,741 |    14 |                 snekbox.nsjail |     INFO | Output exceeded the output limit, sending SIGKILL to NsJail.
2021-02-26 16:02:56,743 |    14 |                 snekbox.nsjail |     INFO | nsjail return code: 137
2021-02-26 16:02:56,744 |    14 |     snekbox.api.resources.eval |    ERROR | An exception occurred while trying to process the request
Traceback (most recent call last):
  File "/snekbox/snekbox/api/resources/eval.py", line 75, in on_post
    result = self.nsjail.python3(code)
  File "/snekbox/snekbox/nsjail.py", line 228, in python3
    Path(self.config.cgroup_mem_mount, cgroup).rmdir()
  File "/usr/local/lib/python3.9/pathlib.py", line 1352, in rmdir
    self._accessor.rmdir(self)
OSError: [Errno 16] Device or resource busy: '/sys/fs/cgroup/memory/snekbox-87fd27a1-d0e9-4387-8160-8d1a985d43e4'

I think that this external killing of nsjail does not let it clear up the child cgroup (which resides in a directory like /sys/fs/cgroup/memory/snekbox-87fd27a1-d0e9-4387-8160-8d1a985d43e4/NSJAIL.12). Once nsjail exits we then try to clear up the parent cgroup (in the example, /sys/fs/cgroup/memory/snekbox-87fd27a1-d0e9-4387-8160-8d1a985d43e4) which cannot succeed because the child cgroup exists.

This PR fixes that by removing the child cgroup before attempting to remove the parent, therefore recursively clearing the tree and ensuring that no cgroup can be busy.

My understanding is that it's safe to remove that cgroup (which I think technically removes the limits from nsjail) because by the point this code is reached the execution has either finished or has been killed.

[coveralls]

Coverage decreased (-1.7%) to 56.855% when pulling 06173ee on recursive-remove-cgroups into af704c1 on master.

[jb3]

Also worth noting that the RAM limits and PID limits are not affected by this, only evaluations which result in a large stdout.

[Akarys42]

It does solve our current issue, thanks captain Joe!