On-access scanning silently misses writes from other mount namespaces

OnAccessMountPath places a mount mark, and a mount mark reports events only for that mount. A writer in its own mount namespace reaches the same superblock through its own copy of the mount, so no event arrives and the file is never scanned — clamonacc stays active and reports nothing. This silently applies to containers and to any systemd unit with private mounts.

Reproducer on a tree watched with OnAccessMountPath:

python3 -c 'open("/watched/plain","w").write(EICAR)'                    # scanned
unshare -m --propagation private python3 -c 'open("/watched/ns","w").write(EICAR)'  # no event

Fix in #1819: an OnAccessFilesystemPath option marking the superblock (FAN_MARK_FILESYSTEM, Linux 4.20), which delivers the event whichever mount the write went through.