[G-01] Remaining PSS restricted gaps

## Summary
After PR #100, every chart-rendered container defaults to `allowPrivilegeEscalation: false`, `capabilities: drop: ["ALL"]`, and `seccompProfile: RuntimeDefault`, and the default Graylog pod passes the "restricted" Pod Security Standard. Two gaps remain: the Datanode still fails "restricted", and `readOnlyRootFilesystem` is unset on both main containers.

### Details
**Datanode.** The 7.0 image entrypoint chowns the data directory as root, then drops to uid 999 via setpriv. The chart default (`values.yaml:451-457`) mirrors that: it adds back CHOWN, DAC_OVERRIDE, FOWNER, SETUID, and SETGID, and leaves `runAsNonRoot` unset. Both violate "restricted". This is no longer blocked upstream: Datanode 7.1+ accepts `GDN_RUN_AS_NONROOT=true` (Graylog2/graylog-docker#306), and the chart-side work is staged on the `datanode-sec-ctx` branch (uid/gid 999, `runAsNonRoot: true`, all capabilities dropped). It is gated on the default image bump to 7.1 (#94) and should land together with it or be version-gated, since older images need the root startup path. Until then the README "Hardened Environments" section documents running the namespace at `baseline`.

**readOnlyRootFilesystem.** Unset on both main containers (`values.yaml:315-322` and 451-457). Both workloads write to the container filesystem, so enabling it needs a write-path audit plus `emptyDir` mounts over each path. The chart has no `extraVolumes`/`extraVolumeMounts` values, so users cannot add the mounts themselves. The `copy-plugin-*` init containers already default it to true.

Out of scope: MongoDB operator pods (default-on, README suggests BYO MongoDB for hardened setups), the opt-in root GeoIP sidecar, and the opt-in privileged `sysctlInit` container.

**Reference:** G-01 (Production Readiness Review)

### Impact
Namespaces enforcing "restricted" reject the Datanode pods, forcing `baseline` or an exemption. Policies requiring read-only root filesystems cannot be satisfied with this chart today.

## Notes for maintainers
- Datanode fix: bump the default image to 7.1 (#94) plus the staged `datanode-sec-ctx` branch.
- readOnlyRootFilesystem: run both workloads with it enabled in a test environment, catalog the write failures, add `emptyDir` mounts, then flip the defaults. Generic `extraVolumes`/`extraVolumeMounts` values would give users an escape hatch.
- Overrides: setting a context value to `null` clears the field. `{}` does not, since Helm coalesces empty maps back to chart defaults.

Start with values.yaml:315-322 and 451-457, then review the datanode-sec-ctx branch and image bump issue #94. Run both workloads in a test environment with readOnlyRootFilesystem enabled and catalog write failures before adding the required mounts. Done means the Datanode passes restricted with the 7.1 image and both main containers use read-only roots without runtime failures.

Written by the indexing model from the issue text.