Add RW filesystem restrictions

[Ham22]

We verify the RO filesystem then go and overlay the whole thing with a RW filesystem. We need to make this more secure. Perhaps only overly a small part of the RO filesystem to control where can be written to.

Previously we have used symlinks from the RO filesystem to the RW filesystem to tightly control exactly which files may be written to. Retaining the overlay is useful for easy factory resets.