box.cfg.read_only supports the 'unless_bootstrap' value

box.cfg.read_only now accepts the string 'unless_bootstrap' along
with the usual booleans. An instance configured this way becomes
writable only if it has bootstrapped the replicaset on the current
startup. It stays read-only if it recovered from a local snapshot or
joined an already bootstrapped replicaset (including a rebootstrap of
a wiped instance into its old registration). The mode is resolved
atomically during the initial box.cfg() call, so the instance never
goes through a transient writable state.
box.cfg.read_only keeps reporting the configured 'unless_bootstrap'
string; the effective state is visible in box.info.ro. The value may
be set only during the initial box.cfg() call, is incompatible with
replication_anon = true and is supported in the TT_READ_ONLY
environment variable as well.
Requested by @okhsunrog in https://github.com/tarantool/tarantool/commit/75ab296f5c3f2d9b7799f798dc9c875704e515e4.

Search the documentation for box.cfg.read_only and start from the box.cfg entry, checking the related box.info.ro and TT_READ_ONLY references. Document the unless_bootstrap behavior, restrictions, and startup cases described in the issue; done means the documented configuration and effective read-only state match this specification.