Add a way to specify `read-only-path` and `masked-pat` when creating a container machine

### Feature or enhancement request details

This would be similar to the work done in https://github.com/apple/container/pull/2069 for `container run/create`

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by reviewing the linked PR 2069 and the code path used to create a container machine. Trace how `read-only-path` and `masked-pat` are represented and passed during creation, then add equivalent support for machine creation and verify that both options are accepted and applied.

Written by the indexing model from the issue text.