Update and fix pre-commit

[hugovk]

See commit messages for full details. Includes:

• Run pre-commit on CI
• Trim trailing whitespace found by pre-commit
• Add more checks to pre-commit including zizmor and fix findings
• Fix typecheck and oxlint warnings, only shown in verbose
• Use native oxlint hook, means it only runs when expected files change
• There's no native typecheck hook, so only run when expected files change