Container security hardening (phase 4) (#24140)

* Support read-only rootfs with self-signed certs in /config/tls

* Support read-only rootfs in s6 and pre-compile bytecode

* Assert read-only rootfs support in CI

* Document hardened read-only deployment

* keep certsync's cert selection identical to nginx's

* note the uid trade-off in user: mode

* fail fast when EXTRA_GROUPS or a missing media volume meets read_only

* keep nosuid and nodev on the /run tmpfs

* support read_only in the default mode

* don't take go2rtc down when the homekit file isn't writable

* lead with the hardware consequence of switching to user:

* refuse to write TLS material through a symlink as root

* note that memryx writes models to the root filesystem

* certsync watches whichever cert path nginx loaded

docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run

@@ -189,7 +189,14 @@ fi
 # Must stay after the sweep, which reads an absent /media/frigate as an
 # unmounted volume rather than a swept one
 if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
-    mkdir -p /media/frigate
+    # The image does not ship this directory, so on a read-only rootfs it can
+    # only come from a mount. Report that rather than failing under errexit.
+    if ! mkdir -p /media/frigate 2>/dev/null; then
+        echo "[ERROR] /media/frigate does not exist and could not be created, which is what happens with read_only: true and no recordings volume." >&2
+        echo "[ERROR] Mount a volume at /media/frigate." >&2
+        echo "[ERROR] See https://docs.frigate.video/configuration/non_root for the compatibility matrix." >&2
+        exit 1
+    fi
     if [[ "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
         chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
     fi