umount: modernizations
namespace: when setting up an inaccessible mount point, unmounting everything below

This has the benefit of not triggering any autofs mount points
unnecessarily.
namespace: also include /root in ProtectHome=

/root can't really be autofs, and is also a home, directory, so cover it
with ProtectHome=.
namespace: beef up read-only bind mount logic

Instead of blindly creating another bind mount for read-only mounts,
check if there's already one we can use, and if so, use it. Also,
recursively mark all submounts read-only too. Also, ignore autofs mounts
when remounting read-only unless they are already triggered.
units: fix minor typo
namespace: cover /boot with ProtectSystem= again

Now that we properly exclude autofs mounts from ProtectSystem= we can
include it in the effect of ProtectSystem= again.
update TODO