We want the virtual kernel to be default-secure. Disable writes to kernel

We want the virtual kernel to be default-secure.  Disable writes to kernel
memory and disable module loading by default when running a virtual kernel.
Run the virtual kernel with the -U option (for Unsecure) to run with these
enabled.

Reads are still allowed since the virtual kernel's memory does not
contain any compromising data from the real kernel.