vfs: Allow chroot if you have CAP_SYS_CHROOT in your user namespace