Mount /proc and /sys read-only, except in privileged containers

Closes #5445


This is a rebase and updates ontop of #5445

ping @jpetazzo