Separate config entries for device mknod and cgroups

I filed a PR to keep this separate [1], but it was closed after [2]
landed.  See also [3], where I point out that putting the mknod stuff
in the “control groups” section is awkward.

[1]: opencontainers/runtime-spec#99
     Add linux.resources.devices
[2]: opencontainers/runtime-spec#94
     Replace Linux.Device with more specific config
[3]: opencontainers/runtime-spec#171 (comment)
     move the description of user ns mapping and default files to proper file

Author: wking