Add runtime read-only mount protection

[madaidan]

This creates the fs.romount_protect sysctl to enable read-only mount protection.

If romount_protect is set to (1), filesystems will be protected in the following ways:

• No new writable mounts will be allowed
• Existing read-only mounts won't be able to be remounted read/write
• Write operations will be denied on all block devices

This is based on GRKERNSEC_ROFS.

[anthraxx]

please rebase against master