core: remount /sys/fs/cgroup/ read-only after we mounted all controllers

Given that glibc searches for /dev/shm by just looking for any tmpfs we
should be more careful with providing tmpfs instances arbitrary code
might end up writing to.