Add a 'deny-write' option

[jaredly]

In my applicaiton, I want to run commands without granting write access to the working directory, which there didn't seem to be an option to make that work. I thought about doing a --dont-auto-allow-cwd or something like that, but I think --deny-write is more generally applicable, as it also works for when you want to exclude writes to a subset of an explicitly allowed file tree.