Add `--read-only` flag to `docker run`

Add `--read-only` flag to `docker run`

This flag further enhances security, however without further changes this flag will generate warnings because the `deno` executable needs to write twice: (1) to generate a dependency analysis cache, and (2) to generate a code cache.

(1) is resolved by adding a command to run `deno` once in the `Dockerfile`, to instantiate the analysis cache during image build.

(2) is resolved by adding `--no-code-cache` to the `deno run` command, which will avoid generating the code cache.