Support `--writable` in `--oci` mode

[dtrudg]

trafficstars

The native singularity runtime --writable flag enables a container to be written to when there is a persistent overlay in a SIF, or the container is a sandbox directory.

At this point it is not clear what the equivalent is of a sandbox directory container, if any. Bundles are temporary in --oci mode.

Persistent overlays inside a SIF for --oci mode are considered in #1480