local invoke of container image lambda should mount file systems readonly

### Describe your idea/feature/enhancement

During development when invoking container image lambdas using `sam local invoke` I wish file systems were mounted readonly (except for `/tmp`) just like they are mounted in AWS. As it is now some bugs can only be found after deployment to AWS.
An example is the bash command `<()` which writes a file descriptor in `/proc/self/fd` which works with `sam local invoke` where `/proc` is writable, but not when deployed to AWS where `/proc` is readonly.
(A solution to this specific problem is to switch to zsh and use `=()` which is a similar command writing a temporary file in `/tmp/zsh...`)

### Proposal

Either always make file systems except `/tmp` readonly when running `sam local invoke` or add a flag that enables/disables mounting file systems readonly.