fix: nginx read_only filesystem compatibility for envsubst (#122)

Redirect NGINX_ENVSUBST_OUTPUT_DIR to /tmp and update nginx.conf include
path so envsubst works with read_only: true in docker-compose.
Add tmpfs mount for /etc/nginx/conf.d for additional write layer.

docker-compose.yml

@@ -52,6 +52,7 @@ services:
       - /tmp:noexec,nosuid,size=64m
       - /var/cache/nginx:noexec,nosuid,size=64m
       - /var/run:noexec,nosuid,size=64m
+      - /etc/nginx/conf.d:noexec,nosuid,size=1m
     cap_drop:
       - ALL