Merge "Mount /data as readonly before encrypt_inplace" into main