chore(code-server): mount the docker socket read-only

The flag does not restrict Docker API access; the README says so.

code-server/compose.yml

@@ -20,6 +20,6 @@ services:
       - PWA_APPNAME=code-server
     volumes:
       - 'code-server-config:/config'
-      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'
 volumes:
   code-server-config: