cmd/snap-confine: aggregate operations holding global lock

[zyga]

This patch moves the code that ensures /snap is rshared next to smilar
operation that initializes the bind mount at /run/snapd/ns. This allows
us to hold avoid one lock/unlock pair. The code is also only running if
non-classic-confinement snaps are in operation. Since classic
confinement snaps don't use any namespaces they don't rely on the /snap
directory being rshared.

Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

[mvo5]

LGTM, we just need to make sure that if we ever change the semantic of classic (to use namespaces) we ensure the shared property moves back to the top. But I guess we need to touch more code in this case so its ok.

[morphis]

LGTM