kernel: add KAP checks for unshare and setns

Thank you for your contribution! Sashiko AI review found 1 potential issue to consider: - [High] security: kap: CLONE_NEWUSER skip in kap_check_namespace_flags() breaks user:unshare rules – commit