Mount /proc and /sys read-only, except in privileged containers

Closes #5445
Fixes #5444


This is a rebase and updates ontop of #5445

ping @jpetazzo