Unshare mount namespace to fix `getcwd`

Previously we would call LazyUnbind as soon as proces starts. This does break getcwd as it starts returning (unreachable) due to mountpoint being gone from chroot.

This removes the need for LazyUnbind and instead unshare mount namespace, making the new process to have it's own mounts that are not shared with parent process. The mounts gets cleaned-up once the process exists.

It was done due to: !325 (comment 404842567)

The `unshare` is needed to fix `os.Getwd()` which does return `(unreachable)`:
https://man7.org/linux/man-pages/man2/getcwd.2.html