nspawn: add --bind= and --bind-ro= to bind mount host paths into the container