new: ``charm`` ressources should be read only

bin/compose

@@ -1936,7 +1936,7 @@ _get_docker_compose_mixin_from_metadata_cached() {
                 if ! [ -e "$dest" ]; then
                     die "charm-resource: '$resource' does not exist (file: '$dest')."
                 fi
-                echo "  - $dest:$resource:rw"
+                echo "  - $dest:$resource:ro"
             done < <(echo "$metadata" | shyaml get-values-0 "charm-resources" 2>/dev/null)
                ) || return 1
         if [ "$volumes" ]; then