Unix: honour forced read-only protection in FUSE mounts

Volume::Open forces read-only protection on a partially encrypted
system volume, but the FUSE backend used the requested protection and
attached the loop device and mounted the filesystem read-write.

Copy the effective protection into the mount options before choosing
the backend. Run the linked mount test in CI, check raw writes and
journal recovery in the VM test, and document that a filesystem
needing journal recovery may refuse a read-only mount.

.github/workflows/build-linux.yml

@@ -25,6 +25,8 @@ on:
       - 'Tests/test.*.hc'
       - 'Tests/test_volume_read.py'
       - 'Tests/volume_read_test.cpp'
+      - 'Tests/test_linux_mount_read_only.py'
+      - 'Tests/linux_mount_read_only_test.cpp'
       - 'Tests/response_apdu_test.cpp'
       - '.github/workflows/build-linux.yml'
   pull_request:
@@ -51,6 +53,8 @@ on:
       - 'Tests/test.*.hc'
       - 'Tests/test_volume_read.py'
       - 'Tests/volume_read_test.cpp'
+      - 'Tests/test_linux_mount_read_only.py'
+      - 'Tests/linux_mount_read_only_test.cpp'
       - 'Tests/response_apdu_test.cpp'
       - '.github/workflows/build-linux.yml'
 
@@ -150,6 +154,10 @@ jobs:
     - name: Read known data from the test volumes
       run: python3 Tests/test_volume_read.py --build-dir src --require-thread-pool
 
+    # The package build above defaults to FUSE2 and leaves matching archives.
+    - name: Check Linux mount protection and fallback
+      run: python3 Tests/test_linux_mount_read_only.py --build-dir src --fuse-package=fuse
+
     - name: Install and test VeraCrypt GUI .deb packages
       run: |
         sudo apt install -y /tmp/VeraCrypt_Packaging/GUI/Packaging/veracrypt-*.deb