Backport: fix(dra): drop redundant /sys hostPath mount breaking container start

[deckhouse-BOaTswain]

Description

The virtualization-dra USB DaemonSet pods never start — they stay in CrashLoopBackOff on every node, so USB device passthrough is unavailable. The main container is privileged and runs with a read-only root filesystem while also bind-mounting the host /sys. Under containerd this combination makes the runtime fail to set up the /sys/fs/cgroup mount on the read-only rootfs, and the container never starts.

A privileged container already gets a read-write /sys from the runtime, so the explicit /sys mount is redundant. It is removed together with its volume and the now-dead /sys entry in the SecurityPolicy host-path allow-list.

Why do we need it, and what problem does it solve?

Without this, the DRA component cannot run at all, and USB devices cannot be passed through to VMs. Verified on a cluster: a privileged pod with a read-only rootfs and an explicit /sys mount crash-loops with the cgroup mount error, while the same pod without that mount starts fine and still has read-write access to /sys/bus/usb.

What is the expected result?

virtualization-dra pods reach Running on all nodes (no CrashLoopBackOff), and USB device passthrough works.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: fix
summary: "USB device passthrough pods no longer fail to start on nodes with a read-only container root filesystem."