Symlink the namespace handle with ContainerID for the port mapping isolator.

This serves two purposes:
1) Allows us to enter the network namespace using container ID (instead of pid): "ip netns exec <ContainerID> [commands] [args]".
2) Allows us to get container ID for orphan containers during recovery. This will be helpful for solving MESOS-2367.

The challenge here is to solve it in a backward compatible way. I propose to create symlinks under /var/run/netns. For example:
/var/run/netns/containeridxxxx --> /var/run/netns/12345
(12345 is the pid)

The old code will only remove the bind mounts and leave the symlinks, which I think is fine since containerid is globally unique (uuid).