Can't mount more filesystems within a read-only mount

Simple example:

```bash
$ bwrap --ro-bind / / --bind . /here true
bwrap: Can't mkdir /here: Read-only file system
```

This can be worked around by creating the target directory for the second mount inside the root of the first mount, or by using something like overlayfs.

If there was a way to work around this in bubblewrap itself, it would be nice, but I'm not sure it's possible. Maybe if overlayfs integration gets added (#412), there could be an option for a "semi-read-only" mount to avoid this issue.

Also, maybe there could be some sort of warning with hints to resolve it if this situation is detected?

While there may not be any practical solution, I'm partly also posting this so anyone else who has this issue doesn't need to spend their weekend debugging it.