nspawn: fix barriers when wiping fully visible procfs/sysfs

nspawn: fix barriers when wiping fully visible procfs/sysfs

Let's wait until the child is fully done with mounting it's own
instances of procfs/sysfs before we destroy our fully visible copies of
it.

This borrows heavily from Christian Brauners fix #29521, but splits the
place + sync into two steps so that the child payload is not started
before the parent has destroyed the procfs instance.

Alternative to: #29521
Fixes: #28157