qubesutils.py: pass readonly mode to libvirt

Fixes QubesOS/qubes-issues#2255

core/qubesutils.py

@@ -424,6 +424,8 @@ def block_attach(qvmc, vm, device, frontend=None, mode="w", auto_detach=False, w
     SubElement(disk, 'target').set('dev', frontend)
     if backend_vm.qid != 0:
         SubElement(disk, 'backenddomain').set('name', device['vm'])
+    if mode == "r":
+        SubElement(disk, 'readonly')
     vm.libvirt_domain.attachDevice(etree.tostring(disk,  encoding='utf-8'))
     try:
         # trigger watches to update device status