mark &T params without UnsafeCell<U> as readonly

These are already marked as `noalias` due to the immutability guarantee
(see 4c2d4cd3dea344e81e4df24382ac3f23e2f86f40), but more information can
be bubbled up to the caller via `readonly`.