anonfd: Allow making anon files read-only