[OpenSearch] Fix readOnlyRootFilesystem by adding emptyDir volumes

[faarshad]

Summary

• Fixes OpenSearch failing to start when securityContext.readOnlyRootFilesystem: true is set
• Adds conditional emptyDir volumes for config, logs, /tmp, and data (when persistence is disabled)
• Adds a config-dir-setup init container that copies the original config directory to a writable emptyDir
• Volumes are only added when readOnlyRootFilesystem is enabled — no change to default behavior

Resolves #369

Changes

• charts/opensearch/templates/statefulset.yaml:
  • Added conditional emptyDir volumes: opensearch-config, opensearch-logs, opensearch-tmp, and opensearch-data (when persistence disabled)
  • Added config-dir-setup init container to copy original config files to writable emptyDir
  • Updated initContainers condition to include readOnlyRootFilesystem
  • Added volumeMounts in main container for all writable paths
• charts/opensearch/Chart.yaml — Bumped chart version from 3.4.0 to 3.5.0
• charts/opensearch/CHANGELOG.md — Documented the fix under [Unreleased] > Fixed

Test plan

• helm lint passes
• helm template with readOnlyRootFilesystem=true renders all emptyDir volumes, mounts, and init container
• helm template without readOnlyRootFilesystem produces no extra volumes (no regression)
• Full E2E on kind cluster (k8s v1.27.3): deployed OpenSearch single-node with readOnlyRootFilesystem=true
  • All EROFS errors are fixed — no read-only filesystem errors in logs
  • No performance-analyzer.log write failures
  • No Java FileSystemException / createTempDirectory errors
  • No opensearch.keystore.tmp write failures
  • Pod reaches Ready 1/1 with zero restarts
• OpenSearch Dashboards connects successfully to the readOnlyRootFilesystem-enabled OpenSearch backend