[CI] Pin to sha all pre-commit hooks and clean up

[jbampton]

Tested with:

pre-commit run --all-files

https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#pre-commit

You can use a # frozen: comment after the rev value to pin a hook to a particular version or version prefix. Dependabot uses this comment to determine whether an update is needed and which tag to resolve.

Example on Apache Airflow:

https://github.com/apache/airflow/blob/fd9241cdf0bb64d5b3c4619be83619db62671824/.pre-commit-config.yaml#L301

---

Lucas-C/pre-commit-hooks@ad1b27d

codespell-project/codespell@2ccb47f

pre-commit/pre-commit-hooks@3e8a870

igorshubovych/markdownlint-cli@e72a3ca

adrienverge/yamllint@cba56bc

gitleaks/gitleaks@83d9cd6

zizmorcore/zizmor-pre-commit@9257c60

rhysd/actionlint@914e7df

tcort/markdown-link-check@3a8992d

oxipng/oxipng@628e241

python-jsonschema/check-jsonschema@f805888

shellcheck-py/shellcheck-py@745efac

editorconfig-checker/editorconfig-checker.python@bebfac8

[steinarb]

@lprimak Not sure I understand how this change is meant to work, based on the description in the PR.
So I will have to study up before I can give any meaningful opinion on this PR (so I hope this isn't hanging on me...).