Gitaly ops fsPolicy OnRootMismatch

What

Sets ops gitaly fsGroupChangePolicy to OnRootMismatch to avoid permission chown on every pod startup.

Why

By default, Kubernetes will chown the whole volume every time the volume is mounted, this changes it to only do that if the owner at the root doesn't match.

Decreases time pod takes to startup.

https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/23594