[syncthing] Mount only `/media`, `/share` and `/backups`

[salim-b]

I was wondering whether we should limit the mounts (map in config.yaml) by

• mounting ssl read-only, i.e. remove the :rw, or even completely removing ssl. Why does Syncthing need access to custom certs in the first place? We have Ingress for that, no?
• removing addons:rw. What is the use case for Syncthing having access to local add-ons? Not even the official File editor add-on has access to addons since it's deemed confusing for non-developers.