Add `--remount-ro` option

Together with `--bindfs`, making a subtree read-only is now easier.