check: mount layer as read-only

mount the image as read-only so it can work also for composefs images.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

check.go

@@ -366,7 +366,7 @@ func (s *store) Check(options *CheckOptions) (CheckReport, error) {
 			if options.LayerMountable {
 				func() {
 					// Mount the layer.
-					mountPoint, err := s.graphDriver.Get(id, drivers.MountOpts{MountLabel: layer.MountLabel})
+					mountPoint, err := s.graphDriver.Get(id, drivers.MountOpts{MountLabel: layer.MountLabel, Options: []string{"ro"}})
 					if err != nil {
 						err := fmt.Errorf("%slayer %s: %w", readWriteDesc, id, err)
 						if isReadWrite {