mark &T params without UnsafeCell<U> as readonly

These are already marked as `noalias` due to the immutability guarantee,
but more information can be bubbled up to the caller via `readonly`.