gVisor stored, locked, and enforced MS_NODEV, but never rendered it. A
remount replaces a mount's whole flag set, so to add a flag userspace
must read the mount's current flags from mountinfo and pass them back.
With nodev missing from that read-back, systemd's sandboxing code
unknowingly requested a remount that would clear nodev — which the
kernel rightly refuses (EPERM) in user namespaces, where preexisting
flags are locked.
Also fix noatime rendering, which overwrote the rw/ro field instead of
appending to it, and match Linux's flag order. Add a syscall test for
both files.
PiperOrigin-RevId: 970083172
