Configure cgroups (v1 or v2) for a jailed Firecracker microVM, including NUMA/CPU pinning via cpuset

Documented steps

1. Pass repeatable `--cgroup <cgroup_file>=<value>` flags to the jailer, e.g. `--cgroup cpuset.mems=0 --cgroup cpuset.cpus=$(cat /sys/devices/system/node/node0/cpulist)` to pin the microVM to NUMA node 0 — this avoids needing a separate privileged process to set cgroups.
2. Select the hierarchy with `--cgroup-version`: default is "1" (cgroup-v1); pass "2" for cgroup-v2. The jailer parses /proc/mounts to locate each required controller's mount point (normally under /sys/fs/cgroup — mount it yourself if absent).
3. Control placement with `--parent-cgroup <relative/path>` (default: the exec-file's filename, e.g. `firecracker`). When any --cgroup is given or --cgroup-version=1, the jailer creates `<cgroup_base>/<parent_cgroup>/<id>`, writes the pid to that cgroup's `tasks` file, and writes each <cgroup_file>=<value>.
4. Alternative v2 flow: with --cgroup-version=2 and NO --cgroup flags, the jailer does not create a cgroup; if the --parent-cgroup path exists it MOVES the process into it (pre-configure the cgroup yourself), and if it doesn't exist the jailer proceeds without joining any cgroup, without error.
5. Existing folders are not an error: the jailer skips creation for directories that already exist (normal for the shared parent folder).
6. Official doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md