cgroup: fix idr leak for the first cgroup root