Make readOnlyRootFilesystem true

It is Helm best practice to set readOnlyRootFilesystem as true, which means that the container filesystem is readOnly and only mounts may be editable, and those mounts are explicitly marked as such- this prevents unknown behaviour when the container image is modified.

This is blocked by dodal importing `ophyd.sim` which creates SynAxis devices as a side effect. This should either be modified within ophyd.sim (which may be problematic as many facilities depend on ophyd.sim for testing) or may be resolved by dodal no longer importing ophyd.sim, which currently requires the [final devices are remade in ophyd-async](https://github.com/DiamondLightSource/mx-bluesky/issues/1076)

## Acceptance Criteria
- The helm values securityContext has readOnlyRootFilesystem by default