Move default writable paths to a dedicated directory

Currently, if you try to run openresty in a K8S cluster that is configured for higher security[0], perhaps runAsUser and/or readOnlyRootFilesystem, you'll get startup errors when openresty attempts to create /usr/local/openresty/nginx/client_body_temp (and etc). To start, you'd need to mount a read-write partition into /usr/local/openresty/nginx, which would override everything there, including the binaries. Even if you were to copy the existing files into the RW mount, you'd open yourself up to bad actors modifying files that they shouldn't.

Ideally, all writable files would be in a dedicated directory, something like /var/run/openresty. That'd include all of the *_temp directories, pid, and possibly logs. Then we can ensure that nobody can replace /usr/local/openresty/nginx/** at runtime.

[0] https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#8-run-containers-as-a-non-root-user

Start by inspecting how the Docker image configures OpenResty’s writable paths, including /usr/local/openresty/nginx/client_body_temp, the other *_temp directories, pid, and logs. Verify the result in a non-root Kubernetes setup with a read-only root filesystem: writable files should use a dedicated directory such as /var/run/openresty while the installation tree remains protected.