syscall: check recorded version of ppid instead of 1

Handles the case where the parent is pid 1 (common in docker
containers).

Attempted and failed to write a test for this.

Fixes #9263.

Change-Id: I5c6036446c99e66259a4fab1660b6a594f875020
Reviewed-on: https://go-review.googlesource.com/1372


Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>