buildFHSEnvBubblewrap: do not use read-only bind on /nix (#463881)

        ${optionalString unshareUts "--unshare-uts"}

        ${optionalString unshareCgroup "--unshare-cgroup"}

        ${optionalString dieWithParent "--die-with-parent"}

        --ro-bind /nix /nix

        --bind /nix /nix

        ${optionalString privateTmp "--tmpfs /tmp"}

        # Our glibc will look for the cache in its own path in `/nix/store`.

        # As such, we need a cache to exist there, because pressure-vessel