Function render_read_only 

pub fn render_read_only(
    read_only_paths: &[String],
    advisory_for: &[String],
) -> String

The read_only block of the scope report: the declared paths, then one line saying whether the protection is enforced for every readable call or advisory against a named binary.

Shared by ScopeReport::render and by mur doctor so the two cannot word the same grant differently — the precedent PreopenReport::render sets. Ends with a newline; emits nothing beyond the <none> line when no path is declared, because there is no enforcement question to answer about a protection nobody asked for.