Fix volume declarations

Did not expect to create anonymous volumes, see
https://stackoverflow.com/questions/46166304/docker-compose-volumes-without-colon
for more details. Now the host directories should be mounted. While here
try setting :ro to the paths we are not expecting to modify. The
/lib/modules :ro flag is based on
3cbd8258eb/cilium-lb.yaml (L143-L145)

global/overlay/etc/puppet/modules/cdn/templates/l4lb/docker-compose.yml.erb

@@ -2,9 +2,9 @@ services:
   l4lb:
     image: "quay.io/cilium/cilium:<%= @cilium_version %>"
     volumes:
-      - /sys/fs/bpf
-      - /lib/modules
-      - /var/run/netns
+      - /sys/fs/bpf:/sys/fs/bpf
+      - /lib/modules:/lib/modules:ro
+      - /var/run/netns:/var/run/netns:ro
     network_mode: "host"
     privileged: true
     command: