Allow passthrough of securityContext.readOnlyRootFilesystem in Helm chart (#43332)

## Issue
Closes #43330 

## Description
This PR allows self-hosted, Kubernetes-based Fleet users to configure
`securityContext.readOnlyRootFilesystem` in `values.yaml`, which is then
propagated down to the `deployment.yaml` template.

This change provides a convenient mechanism for users to fix a known
issue while preserving the current default behavior.

## Testing
The underlying `deployment.yaml` change has been tested in a standard
Google Kubernetes Engine cluster, and is confirmed to fix the linked
issue when using either Ubuntu-based or Container-Optimized OS
(COS)-based `containerd` container runtimes in GKE.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Chores**
* Enhanced fleet container security by making the read-only root
filesystem setting configurable. Deployments can now customize this
security parameter to meet specific requirements, while secure defaults
are automatically applied for standard installations that don't require
custom configuration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

charts/fleet/templates/deployment.yaml

@@ -448,7 +448,11 @@ spec:
           capabilities:
             drop: [ALL]
           privileged: false
+          {{- if hasKey .Values.fleet.securityContext "readOnlyRootFilesystem" }}
+          readOnlyRootFilesystem: {{ .Values.fleet.securityContext.readOnlyRootFilesystem }}
+          {{- else }}
           readOnlyRootFilesystem: true
+          {{- end }}
           {{- if .Values.fleet.securityContext.runAsGroup }}
           runAsGroup: {{ int64 .Values.fleet.securityContext.runAsGroup }}
           {{- end }}

charts/fleet/values.yaml

@@ -125,8 +125,9 @@ fleet:
     licenseKey: license-key
   extraVolumes: []
   extraVolumeMounts: []
-  # Currently only passes runAsNonRoot, runAsUser, runAsGroup
+  # Currently only passes readOnlyRootFilesystem, runAsNonRoot, runAsUser, runAsGroup
   securityContext:
+    readOnlyRootFilesystem: true
     runAsNonRoot: true
     runAsUser: 3333
     runAsGroup: 3333