fstab-generator: clear nosuid/nodev/noexec for root=bind: mounts

A bind mount inherits the mount flags of the file system the source
directory resides on. For root=bind: the source typically lives below
/run/ (e.g. a freshly unpacked tar image in /run/machines/), which is
mounted nosuid,nodev, so those flags propagated to /sysroot and broke
suid binaries (e.g. sudo) and device nodes on the booted system.

Default bind root mounts to dev,suid,exec instead, unless the user
overrides this via rootflags=.

Fixes: https://github.com/systemd/systemd/issues/41352

Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>

test/test-fstab-generator/test-22-bind.expected/initrd-root-fs.target.requires/sysroot.mount

@@ -0,0 +1 @@
+../sysroot.mount

test/test-fstab-generator/test-22-bind.expected/initrd-usr-fs.target.requires/sysroot.mount

@@ -0,0 +1 @@
+../sysroot.mount

test/test-fstab-generator/test-22-bind.expected/sysroot.mount

@@ -0,0 +1,12 @@
+# Automatically generated by systemd-fstab-generator
+
+[Unit]
+Documentation=man:fstab(5) man:systemd-fstab-generator(8)
+SourcePath=/proc/cmdline
+Before=initrd-root-fs.target
+After=imports.target
+
+[Mount]
+What=/run/machines/root
+Where=/sysroot
+Options=rw,bind,suid,dev,exec

test/test-fstab-generator/test-22-bind.input

@@ -0,0 +1 @@
+root=bind:/run/machines/root