security: pin all pre-commit hooks to SHA

[jbampton]

Examples:

https://github.com/apache/airflow/blob/76ffb4693feb30c5e1e9f7e0a5e630d0c59a5d63/.pre-commit-config.yaml#L422

https://github.com/apache/shiro/blob/8e0e4ac7a7af35c8c8ec552b51cf3bd809196622/.pre-commit-config.yaml#L77

refs apache/tooling-trusted-releases#1591