switch unlock_mount() to namespace_unlock(), convert all umount_tree() callers