security: mark LSM hooks as __ro_after_init