Fix #47: Document cgroups args changes

[sibprogrammer]

No description provided.

[vizovitin]

While it would be slightly more secure to run with --cgroupns=private, which in general works, it seems to require more setup in some cases and may not work well on some configurations (didn't check the latter, so mostly speculation from my side).
So --cgroupns=host is probably not much worse than what we had before with Cgroups v1.

However, I propose to additionally add --cap-add SYS_ADMIN --security-opt apparmor=unconfined, which get rid of some warnings during init and some undesired behaviors during stop. Probably doesn't make the security much worse anyway.

For future reference:

• Unable to run systemd in docker with ro /sys/fs/cgroup after systemd 248 host upgrade moby/moby#42275
• https://github.com/LewisGaul/systemd-containers