root should be mounted ro

[wesolows]

See oxidecomputer/omicron#4292. This depends on that and covers the much simpler part of the problem: actually creating rpool/ROOT or whatever filesystem we're going to use as the root with the appropriate properties to be mounted read-only. Most likely this is simply readonly=on.