forensic-mark-readonly: check only for boot option read-only