cgroup: make hierarchy iterators deal with cgroup_subsys_state instead of cgroup