Cleanup `sec-check` mount flag checks.

This structures the checks in a manner that is a bit more sane and that
is more correct (nodev in /dev wasn't right.)