Explicitly set bind mounts' propagation type to private

If I understand it correctly, the default propagation type is private,
but f**king systemd mounts everything as shared. This is especially
problematic when doing recursive bind, which is not our case, but still
better to explicitly set propagation to private anyway.

See: https://lwn.net/Articles/689856/, https://lwn.net/Articles/690679/