molecule/debian11: Mount sys/kernel/security as read only

The scylla-monitor container, during the docker installation/configuration was running
apparmor_parser, which, as a result, was replacing the host's `docker-default` AppArmor profile.
As a consequence of that, some subsequent socket creation attempts coming from the scylla-monitor container
itself and from other containers on the host were being blocked by the kernel, with the following messages:
```
type=1400 audit(1778707767.526:165): apparmor="DENIED" operation="create" class="net" profile="docker-default" pid=509120 comm="alertmanager" family="netlink" sock_type="raw" protocol=0 requested="create" denied="create"
```

```
type=1400 audit(1778707703.706:137): apparmor="DENIED" operation="create" class="net" profile="docker-default" pid=504003 comm="dnf" family="inet6" sock_type="dgram" protocol=0 requested="create" denied="create"
```

By mounting `/sys/kernel/security` as read only, we prevent the scylla-monitor's docker
installation from touching the host's docker-default AppArmor profile.

This behavior, so far, has been observed only on debian11, thus this change is being applied only
for the debian11 molecule.

Author: igorribeiroduarte

molecule/debian11/molecule.yml

@@ -55,6 +55,7 @@ platforms:
     cgroupns_mode: host
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup
+      - /sys/kernel/security:/sys/kernel/security:ro # Prevent container from modifying host AppArmor profile
       - /var/lib/docker # https://github.com/docker/for-linux/issues/1138
     groups:
       - scylla-monitor