feat(data): upgrade OpenSearch to v3 with ML Commons for neural search

- Upgrade from OpenSearch 2 to 3 (required for ML Commons pre-trained models)
- Rename PLUGINS_SECURITY_DISABLED → DISABLE_SECURITY_PLUGIN (OS3 change)
- Enable ML Commons plugin settings for on-data-node inference
- Increase memory limits (2Gi) and JVM heap for neural model inference
- Add fsGroup security context for volume permissions

base/data/opensearch-deployment.yaml

@@ -13,6 +13,8 @@ spec:
       labels:
         app: opensearch
     spec:
+      securityContext:
+        fsGroup: 1000
       initContainers:
         - name: sysctl
           image: busybox
@@ -21,7 +23,7 @@ spec:
             privileged: true
       containers:
         - name: opensearch
-          image: opensearchproject/opensearch:2
+          image: opensearchproject/opensearch:3
           ports:
             - name: http
               containerPort: 9200
@@ -33,14 +35,22 @@ spec:
             - name: discovery.type
               value: single-node
             - name: OPENSEARCH_JAVA_OPTS
-              value: "-Xms512m -Xmx1g"
+              value: "-Xms1g -Xmx1536m"
             - name: DISABLE_SECURITY_PLUGIN
               value: "true"
+            - name: plugins.ml_commons.only_run_on_ml_node
+              value: "false"
+            - name: plugins.ml_commons.native_memory_threshold
+              value: "90"
+            - name: plugins.ml_commons.model_access_control_enabled
+              value: "false"
+            - name: plugins.ml_commons.allow_registering_model_via_url
+              value: "true"
           resources:
             limits:
-              memory: 1500Mi
+              memory: 2Gi
             requests:
-              memory: 768Mi
+              memory: 1Gi
               cpu: 100m
           volumeMounts:
             - name: data