bpf: harden flags check in cgroup_storage_update_elem()