virt-aa-helper: don't deny writes to readonly mounts
    
    There is no need to deny writes on a readonly mount: write still
    won't be accepted, even if the user remounts the folder as RW in
    the guest as qemu sets the 9p mount as ro.
    
    This deny rule was leading to problems for example with readonly /:
    The qemu process had to write to a bunch of files in / like logs,
    sockets, etc. This deny rule was also preventing auditing of these
    denials, making it harder to debug.