Wrap all API response types in `Readonly`

[david-crespo]

Seems like the right thing to do. I don't think we'd want to do it for request bodies because we might mutate them while building them. If there are any types used for both a request and response, we can just leave Readonly off.