Add support for read-only /root

[rmsc]

Currently, ssh key injection assumes /root is writable, which might not always be the case.

I've worked around this for ephemeral runs by injecting a systemd mount unit for mounting tmpfs to /root/.ssh via --systemd-units. This leaves /root read-only, which keeps it close to the original image:

Unfortunately bcvk to-disk doesn't support --systemd-units, so it just gets stuck at Reached target sshd-keygen.target.

Maybe it might be useful to inject this unit by default, keeping .ssh in tmpfs? The unit itself is really simple:

[Unit]
Description=Transient BCVK Writable Root SSH Directory
DefaultDependencies=no
Conflicts=umount.target
Before=local-fs.target

[Mount]
What=tmpfs
Where=/root/.ssh
Type=tmpfs
Options=mode=0700,noatime,nodev,nosuid,noexec

[Install]
WantedBy=local-fs.target