This also implements security-context template to add readOnly-fs flag Change-Id: Iaeea66dad34a2616c0620eafacc53574ed79a7b5