cgroup: protect cgroup_root->cgroup_idr with a spinlock