Preserve nosymfollow across bind-mount flag fixups

[tjunnone]

When bubblewrap binds a host mount that was mounted nosymfollow (for example systemd credential mounts), the flag is silently cleared inside the sandbox whenever the bind triggers bubblewrap's flag-fixup remount.

Example:

unshare -rm sh -c '
  mkdir -p /mnt/nsf
  mount -t tmpfs -o nosymfollow tmpfs /mnt/nsf
  printf secret > /mnt/nsf/x
  ln -s x /mnt/nsf/l
  cat /mnt/nsf/l                       # host:    Too many levels of symbolic links
  bwrap --ro-bind / / cat /mnt/nsf/l   # sandbox: prints "secret"
'

Expected: the sandbox refuses to follow the symlink (ELOOP), just like the host.
Actual: the sandbox prints secret, as nosymfollow was dropped.

This happens because decode_mountoptions parses the mount's flags from /proc/self/mountinfo through a table that has no nosymfollow entry. The fixup remount then passes only the decoded flags and nosymfollow is cleared. The fix is to add the table entry. A test entry for the case is also added to test-run.sh for good measure.