Implement read-only file system parameter

[n0toose]

It would be interesting to add a flag that does not allow for any modifications to the host OS's file system, like virtio-fs does. write should return an error and, once merged, Landlock (#816) should only derive rulesets with read-only access and prohibit write operations as well.

See: #896

[n0toose]

Idea: We have a --file-isolation parameter, perhaps we could use it to do --file-isolation=readonly and alias --readonly to that.

[jounathaen]

Docker does this via a flag upon volume mounting: -v volume-name:/path/in/container:ro. As we try to stick to the docker syntax anyway, I'd propose this instead of a separate flag.