CNI isolator should mount network related /etc/* files in readonly mode

The CNI isolator bind mounts, even for containers using host networking, several files from /etc, such as resolv.conf. These should be mounted as readonly inside the container to prevent users running inside the container as root from being able to affect the external machine.