By setting all host-mounted volumes to be read-only we reduce the likelihood
any host filesystem is modified by running kube-bench.