tdb2: add TDB_RDONLY flag, allow setting/unsetting it.