cgroups: fix lock inconsistency in cgroup_clone()