See https://github.com/bootc-dev/bootc/discussions/1036

Add `root = transient-ro`

Like `root = transient` but we'd allocate the overlayfs upper, but still keep it read-only by default. This would make it easy for code running in the real root to unshare the mount namespace, mount it writable and mutate it while still keeping it read-only for most use cases. This would be a pretty easy addition to ostree-prepare-root.