debugfs: more tightly restrict default mount mode