nspawn: fix the comment about which namespaces outer_child is in

nspawn: fix the comment about which namespaces outer_child is in

The comment says that it is still in the host's CLONE_NEWUSER namespace,
which is not true if !arg_privileged.  Also, it says that the CLONE_NEWNS
namespace was created by clone(), but if !arg_privileged then it was
actually created by nsresource_allocate_userns() and switched into by
setns().  Fix those inaccuracies.

When trying to word it clearly, there are enough commas and nested clauses
that I think it's clearer to break it into a list/table.