Adds flag to denote root-filesystem should be made read-only.

Needed for downstream work and re-vendoring in faas-swarm/faas-
netes and openfaas-operator.

Closes #723

Signed-off-by: Alex Ellis (VMware) <alexellis2@gmail.com>