Add pre-commit for bandit, codespell, and flake8

[cclauss]

As discussed at #629 (comment) add https://pre-commit.com for our fastest lint steps (bandit, codespell, flake8, and soon black and isort) to run locally in the git commit process and also in .github/workflows/ci.yml.

• Land this PR.
• Land the black/isort PR (after Fix unused variables: flake8 --select=F841 #623) and un-comment those tasks.
• Enable precommit.ci for this repo (autofixing) and then remove from ci.yml.

[amacneil]

Open to input from other contributors, but I'm personally not convinced of the utility of this. I prefer to keep pre-commit hooks as something people can configure if they like that approach, and I'd advocate for keeping our CI all in one place (Github Actions) and limit it to running simple scripts (which can easily be run locally as well) rather than adding a dependency on another service (https://pre-commit.ci/) which will have its own downtime, potentially change or go away in the future, etc (not making any claims that its downtime is better or worse than Github Actions, just that we would now have two services that can fail).

My preferences here are because I prefer editor integration (e.g. #629) and automatic formatting of files on save rather than pre-commit hooks or some service appending commits to PRs (shift left philosophy).

[cclauss]

This PR runs pre-commit on GitHub Actions.

I have removed the alternative CI task above to autocorrect errors.