Bind mounts of config files and the like should be read-only

`compose.yml` has many bind mounts to config files. If you don't make them read-only by appending `:ro`, for an attacker who compromises a container can edit the configuration and for example add a persistent backdoor.

Perhaps the most glaring example is this:

`- ${VOLUME_PATH}/data/ssl/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt`

An attacker can edit the host's list of CA certificates, and also for all other containers that mount this.

Generally, if in doubt, bind mounts should be read-only. Only if there is a clear reason for why the container should be able to write, `:rw` is appropriate. In my experience, this is the exception.