Use s6-overlay read-only mode by default (#5906)

To avoid accidential writes to the Supervisor root filesystem, we might
use the Docker read-only mode at one point. This is not yet the default,
but using s6-overlay with the read-only flag seems not to have any
downsides. So enable this by default.

To start Supervisor with read-only root file system teh following
arguments have to be used: `--read-only --tmpfs /run:exec`.

Dockerfile

@@ -2,6 +2,7 @@ ARG BUILD_FROM
 FROM ${BUILD_FROM}
 
 ENV \
+    S6_READ_ONLY_ROOT=1 \
     S6_SERVICES_GRACETIME=10000 \
     SUPERVISOR_API=http://localhost \
     CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 \