linux-container: Support having a read-only root file system.

Until now, the read-only file system set up by ‘call-with-container’
would always be writable.  With this change, it can be made read-only.
With this patch, only ‘least-authority-wrapper’ switches to a read-only
root file system.

* gnu/build/linux-container.scm (remount-read-only): New procedure.
(mount-file-systems): Add #:writable-root? and #:populate-file-system
and honor them.
(run-container): Likewise.
(call-with-container): Likewise.
* gnu/system/linux-container.scm (container-script): Pass #:writable-root?
to ‘call-with-container’.
(eval/container): Add #:populate-file-system and #:writable-root? and
honor them.
* guix/scripts/environment.scm (launch-environment/container):
Pass #:writable-root? to ‘call-with-container’.
* guix/scripts/home.scm (spawn-home-container): Likewise.
* tests/containers.scm ("call-with-container, mnt namespace, read-only root")
("call-with-container, mnt namespace, writable root"): New tests.

Change-Id: I603e2fd08851338b737bb16c8af3f765e2538906

guix/scripts/environment.scm

@@ -961,6 +961,7 @@ WHILE-LIST."
                                  #:emulate-fhs? emulate-fhs?)))
           #:guest-uid uid
           #:guest-gid gid
+          #:writable-root? #t                     ;for backward compatibility
           #:namespaces (if network?
                            (delq 'net %namespaces) ; share host network
                            %namespaces)))))))

guix/scripts/home.scm

@@ -377,6 +377,7 @@ immediately.  Return the exit status of the process in the container."
                     (type "tmpfs")
                     (check? #f)))
    #:mappings (append network-mappings mappings)
+   #:writable-root? #t
    #:guest-uid uid
    #:guest-gid gid))