Also set the read-only option on the server

The read-only option is requested to the remote side, by an sshfs
parameter. Therefore, a (remote) modified sshfs version may ignore the
read-only option, allowing to write to the local path.

To fix this security issue, the server (the local host) must also set
the read-only option if necessary.