Add the ability to mark a profile as "read only"

From a mail thread.

Say an application author wants to add a fragment profile for their app. They want to turn on a bunch of specific settings for that app, like, closeOnExit. But they REALLY REALLY don't want users overriding those properties. The app author should be able to specify some way that indicates that this profile can no longer be layered on top of.

addenda:

• when we have arbitrary profile layering (#2933 is similar but not what I was thinking), then does readOnly prevent a user profile from being layered by other profiles?
• Do we throw a warning when the user tries to add properties in their settings to a readonly profile? (probably)
• What happens if they mark profiles.defaults as readonly? (probably warn them, because that's an obvious footgun)

Start by tracing how profile layering and profiles.defaults are represented and validated. Resolve whether read-only profiles block later layering, how user overrides are reported, and what happens when profiles.defaults is marked read-only; done means the behavior and warnings are defined and covered by tests.