[Request]: Nested bind mounts (make a directory read-only within a mount, etc.)

### Feature or enhancement request details

When two or more bind mounts are supplied and a target of the latter one is a subdirectory of the target of a prior one, the inner mount should be "overlaid." (Docker supports this "mount-over-mount" layering.)

For example, if within an entire directory structure you want to make a particular folder read-only so that it is not overwritten or mutated from inside a container:
```yml
- ./dir1:/dir1
- ./dir1/locked:/dir1/locked:ro
- ./dir2:/dir1/alternate
```

**Result:** `/dir1` is read-write, but `/dir1/locked` is read-only.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Use the nested bind-mount example in the issue as the starting acceptance case, focusing on a later mount whose target is inside an earlier mount. Done means the inner mount overlays the outer mount and preserves its read-only option, while the surrounding mount remains read-write; no files or tests are named in the issue.

Written by the indexing model from the issue text.