[Request]: Document --volume's three-part form ("host:guest:opts") and clarify support of other mount options, e.g. nosuid.

### Feature or enhancement request details

The parser for the `--volume` flag accepts an undocumented form: `hostpath:guestpath:options`. Is this form part of the stable and supported CLI?

As far as I can tell these options are passed all the way through to the Containerization package's [Sources/ContainerizationOS/Mount/Mount.swift](https://github.com/apple/containerization/blob/2f947e76143c79e94fa5403ac74ff8d9bd9f0319/Sources/ContainerizationOS/Mount/Mount.swift), where they're mapped onto the kernel's `MS_*` flags. However, for virtiofs bind mounts the options are only applied if `ro / MS_RDONLY` is specified. If this form is part of the stable/supported CLI, is it a bug or intended behavior that other mount options, such as `nosuid`, are silently dropped without the `ro` option for virtiofs bind mounts?

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start at the --volume parser and read the linked Sources/ContainerizationOS/Mount/Mount.swift to trace the three-part form and mount-option handling. Document whether hostpath:guestpath:options is supported, list the supported options, and clarify whether virtiofs dropping options such as nosuid without ro is intended or a bug.

Written by the indexing model from the issue text.