doc: make clear that isolation-container can be unprivileged

The isolation-container restriction does not specify if the container is privileged or not, therefore an unprivileged container must be assumed.