Mount an emptyDir for the Next.js cache in rallly (5.0.0+up4.12.3)

The chart mounted no volumes at all while running with
readOnlyRootFilesystem: true, so every Next.js write to
/app/apps/web/.next/cache failed. The image optimizer's failure even
surfaced as an unhandledRejection, so this was more than log noise.

The cache path is now a writable emptyDir; path and an optional
sizeLimit are configurable under rallly.cache. The hardening is
untouched — the pod's existing fsGroup (1000) is what makes the mounted
volume writable for uid 20000.

Verified in a throwaway k3d cluster which paths the app actually writes:
with a fully writable root filesystem and the cache mounted, the only
path the container touches is the cache directory itself. /tmp, $HOME
(=/app) and the rest of the root filesystem stay untouched, so no second
mount is needed.

Also drops the vestigial "capabilities.add: []": Trivy's AVD-KSV-0022 for
rallly (#84) comes from the older chart version deployed in the cluster,
which rendered a null list entry under add:. Reproduced with trivy config
against both renderings; the app needs no capabilities.

Major bump: runtime behavior changes, a volume is added.

Fixes #60

rallly/templates/rallly.deployment.yaml

@@ -150,4 +150,18 @@ spec:
             {{- include "rallly.resources" .Values.rallly.resources | nindent 12 }}
           securityContext:
             {{- toYaml .Values.rallly.securityContext.container | nindent 12 }}
+          volumeMounts:
+            # Next.js writes prerendered pages and optimized images into its
+            # cache directory; with a read-only root filesystem this must be a
+            # writable volume (see rallly.cache in values.yaml).
+            - name: next-cache
+              mountPath: {{ required "A cache path must be provided (rallly.cache.path)" .Values.rallly.cache.path | quote }}
+      volumes:
+        - name: next-cache
+          {{- if .Values.rallly.cache.sizeLimit }}
+          emptyDir:
+            sizeLimit: {{ .Values.rallly.cache.sizeLimit | quote }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
       restartPolicy: Always