Resource template doesn't work if readOnlyRootFileSystem is enforced

### Pre-requisites

- [X] I have double-checked my configuration
- [X] I can confirm the issues exists when I tested with `:latest`
- [ ] I'd like to contribute the fix myself (see [contributing guide](https://github.com/argoproj/argo-workflows/blob/master/docs/CONTRIBUTING.md))

### What happened/what you expected to happen?

Hi,

Argo workflow chart configurations:
For Controller, the main container, and wait container(executor) we are enforcing readOnlyRootFileSystem flag for security context. Other sample workflows which have container, and script template all worked fine. Only the Resource template is failing with the below logs.
```
time="2023-03-29T10:41:13.128Z" level=error msg="executor error: open /tmp/manifest.yaml: read-only file system"
time="2023-03-29T10:41:13.128Z" level=fatal msg="open /tmp/manifest.yaml: read-only file system"
```
Workflow - https://github.com/argoproj/argo-workflows/blob/master/examples/k8s-owner-reference.yaml )
Reference - https://blog.argoproj.io/practical-argo-workflows-hardening-dd8429acc1ce

Is there any workaround to make resource template work when allowPrivilegeEscalation when set to false. Thanks

### Version

latest

### Paste a small workflow that reproduces the issue. We must be able to run the workflow; don't enter a workflows that uses private images.

```YAML
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: k8s-owner-reference-
labels:
workflows.argoproj.io/test: "true"
annotations:
workflows.argoproj.io/description: |
This example creates a Kubernetes resource that will be deleted
when the workflow is deleted via Kubernetes GC.

A workflow is used for this example, but the same approach would apply
to other resource types.

https://kubernetes.io/docs/concepts/workloads/controllers/garbage-collection/
spec:
entrypoint: main
templates:
- name: main
resource:
action: create
setOwnerReference: true
manifest: |
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: owned-eg-
spec:
entrypoint: main
templates:
- name: main
container:
image: argoproj/argosay:v2
```

### Logs from the workflow controller

```text
kubectl logs -n argo deploy/workflow-controller | grep ${workflow}
time="2023-03-29T10:41:13.128Z" level=error msg="executor error: open /tmp/manifest.yaml: read-only file system"
time="2023-03-29T10:41:13.128Z" level=fatal msg="open /tmp/manifest.yaml: read-only file system"
```

### Logs from in your workflow's wait container

```text
kubectl logs -n argo -c wait -l workflows.argoproj.io/workflow=${workflow},workflow.argoproj.io/phase!=Succeeded

time="2023-03-29T10:41:13.128Z" level=error msg="executor error: open /tmp/manifest.yaml: read-only file system"
time="2023-03-29T10:41:13.128Z" level=fatal msg="open /tmp/manifest.yaml: read-only file system"
```