cgroup: css_set_lock should nest inside tasklist_lock