Doing this is the source of sandstorm-io#3584.

Instead, make sure we've fully entered a new user namespace before
we have to do anything that would require the capabilities that are
dropped on exec(). We also need to be in a new pid namespace, since
we try to mount /proc so it needs to be a procfs that we own. We use
clone() instead of unshare() for this so we don't have to disturb
the process hierarchy.

This fixes sandstorm-io#3239 by providing a config option to re-enable the ability
to upgrade demo accounts to full accounts, which was removed in order to
allow alpha to act as the demo server when oasis was shut down.

Unfortunately, this seems to break *other* tests. The handful I examined
resulted in permission errors trying to upload the test app; presumably
when this is enabled our test accounts are somehow getting marked as
not allowed to upload their own apps.