Let --rw override --ro on a child path by emitting ro binds first

src/sandbox.rs

@@ -28,13 +28,13 @@ pub fn build_command(config: &SandboxConfig) -> Result<Command, SandboxError> {
         cmd.arg("--bind-try").arg(&path).arg(&path);
     }
 
+    for path in &config.extra_ro {
+        add_ro_bind(&mut cmd, path)?;
+    }
     add_rw_bind(&mut cmd, &config.chdir)?;
     for path in &config.extra_rw {
         add_rw_bind(&mut cmd, path)?;
     }
-    for path in &config.extra_ro {
-        add_ro_bind(&mut cmd, path)?;
-    }
 
     add_env_policy(&mut cmd, config);
     add_user_env_overrides(&mut cmd, config);