do not make the filesystem of the container writable

We do not need to have the container file system writable. It's enough that bind paths are mounted in read/write mode.

It also fixes the execution (in the new nightlies) of the XMLSummaryKernel.writeerror test in LHCb which relies on the fact that the test can't write to /, AFAIU.