image.yaml: enable sysroot-ro

We want to use the new read-only `/sysroot` feature of libostree. Opt-in
to that to tell cosa we support it and want it.

For more details, see:
ostreedev/ostree#1265
coreos/coreos-assembler#1235

image.yaml

@@ -13,6 +13,10 @@ extra-kargs:
 # Optional remote by which to prefix the deployed OSTree ref
 ostree-remote: fedora
 
+# We want read-only /sysroot to protect from unintential damage.
+# https://github.com/ostreedev/ostree/issues/1265
+sysroot-ro: true
+
 # After this, we plan to add support for the Ignition
 # storage/filesystems sections.  (Although one can do
 # that on boot as well)