cgroup: Fixes for v7.0-rc6

- Fix cgroup rmdir racing with dying tasks. Deferred task cgroup unlink
  introduced a window where cgroup.procs is empty but the cgroup is still
  populated, causing rmdir to fail with -EBUSY and selftest failures. Make
  rmdir wait for dying tasks to fully leave and fix selftests to not depend
  on synchronous populated updates.

- Fix cpuset v1 task migration failure from empty cpusets under strict
  security policies. When CPU hotplug removes the last CPU from a v1
  cpuset, tasks must be migrated to an ancestor without a
  security_task_setscheduler() check that would block the migration.

cgroup/cpuset: Skip security check for hotplug induced v1 task migration

When a CPU hot removal causes a v1 cpuset to lose all its CPUs, the
cpuset hotplug handler will schedule a work function to migrate tasks
in that cpuset with no CPU to its ancestor to enable those tasks to
continue running.

If a strict security policy is in place, however, the task migration
may fail when security_task_setscheduler() call in cpuset_can_attach()
returns a -EACCES error. That will mean that those tasks will have
no CPU to run on. The system administrators will have to explicitly
intervene to either add CPUs to that cpuset or move the tasks elsewhere
if they are aware of it.

This problem was found by a reported test failure in the LTP's
cpuset_hotplug_test.sh. Fix this problem by treating this special case as
an exception to skip the setsched security check in cpuset_can_attach()
when a v1 cpuset with tasks have no CPU left.

With that patch applied, the cpuset_hotplug_test.sh test can be run
successfully without failure.

Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>