nspawn: mount os-release in two steps to make it read-only

The kernel interface requires setting up read-only bind-mounts in
two steps, the bind first and then a read-only remount.
Fix nspawn-mount, and cover this case in the integration test.

Fixes #16484