Add opt-in support to readonly `/etc`, also doc transient overlayfs for `/etc`

We want bootc to support both "generic, unlocked" systems that have persistent mutable state in `/etc`, as well as "sealed" systems that are *only* configured via bootc, and shouldn't have persistent mutable configuration.

(Similar, for `/var`, though in the general case for that I think people will instead want to allow-list at least some persistent paths, like the journal)
