Ordering of mounts

I spent quite some time on this before realising what was happening. The ordering of the mounts seem to matter, else you get an error that isn't completely obvious (well to me anyway).

A working example:
`/usr/bin/bwrap --ro-bind /tmp/sandbox / --proc /proc [command]`

Whereas with the mounts reversed:

```
/usr/bin/bwrap --proc /proc --ro-bind /tmp/sandbox / [command]
Can't bind mount /oldroot/tmp/sandbox on /newroot/: Invalid argument
Can't read from privileged_op_socket
```

Is this a bug or user fail to understand/read the docs? Either way, would still be nice to point this out to other users as an issue (with solution)