vm-secure: add nodev,noexec,nosuid mount flags

Adds the nodev, noexec and nosuid mount flags to the root mounts. To ensure that system flatpak installations still work, a tmpfiles configuration is added which creates /var/lib/flatpak as a subvolume, which then gets mounted with only nodev and nosuid.