fix(alloy): drop read_only so the inline compose config can be created

Compose materialises a configs: entry with inline content by writing it into
the container and refuses to do so on a read-only service: "cannot create
config ... : `file` is the sole supported option". The container was created
without /etc/alloy/config.alloy and the deployment failed at start.

Keeping the config inline matters more than the read-only rootfs, so the flag
and its tmpfs go. Every other control stays: no privileged, cap_drop ALL with
only DAC_OVERRIDE added, no-new-privileges, the socket proxy, and the limits.

alloy/docker-compose.yml

@@ -13,9 +13,6 @@ services:
     cap_add: [DAC_OVERRIDE]                   # read host files owned by other uids: journal, /rootfs, /var/log
     security_opt:
       - no-new-privileges:true
-    read_only: true
-    tmpfs:
-      - /tmp
     mem_limit: 2g
     pids_limit: 512
     depends_on: