fix: preserve named volume access mode in compose randomize transform

[tanaymishra]

What is this PR about?

When a Compose service is deployed with "Randomize" or "Isolated Deployment" (with volume isolation), Dokploy appends a suffix to volume names. The transform split each short-syntax volume mount on ":" and kept only the name and path, which silently dropped the access mode. A named read-only volume like data:/var/lib/mysql:ro became data-<suffix>:/var/lib/mysql, so a read-only mount turned read-write, and the SELinux :z / :Z relabel flags were lost.

This PR preserves any segments after the container path and re-appends them, so data:/var/lib/mysql:ro becomes data-<suffix>:/var/lib/mysql:ro. Bind mounts and long-form (type: volume) entries are unchanged. A regression test is added covering :ro on a named volume and :z on a subdirectory volume.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. Verified via the compose test suite (142 tests pass, including the new mode-preservation regression test) and tsc --noEmit on both @dokploy/server and apps/dokploy.

Issues related (if applicable)

closes #4818

Screenshots (if applicable)

Not applicable (backend compose transform). Behavior is covered by the added unit test.