Opt-out for /sys and /proc

Opt-out for /sys and /proc

I still feel like these should be opt-in, but the consensus is that
they should be opt-out [1].  That is currently blocking on suggested
syntax around that opt-out.  My suggestion [1] was to borrow the
maskedPaths syntax from [2], but I haven't heard any direct responses
to that.

[1]: Message-ID: <20151216215513.GG25571@odin.tremily.us>
     Subject: Re: Linux: Don't mount /sys and /proc (i.e. rolling back specs#164)
     Date: Wed, 16 Dec 2015 13:55:13 -0800
[2]: https://github.com/opencontainers/specs/pull/186
     Subject: Masked paths setting in the container