pidns: Capture the user namespace and filter ns_last_pid