We used to have PROT_READ | PROT_WRITE and MAP_PRIVATE for readonly
maps. However, this would reserve copy-on-write space and make the
service OOM. We could also use MAP_NORESERVE to avoid committing for
that much memory in advance, but we really don't need to have writable
space at all, so we just set the prot flags properly.