Add basic pre-commit config (#39545)

From https://pre-commit.com/

```
pip install pre-commit
pre-commit --version
pre-commit install
pre-commit run --all-files
```

This only configures the basic `check-yaml` rule, and fixes an offending
spot where a patch was named like a yaml. See, it's helping already!

Next:
- add any other configs that might be worthwhile
- add a CI check that runs `pre-commit` post-commit

---------

Signed-off-by: Jason Hall <jason@chainguard.dev>

Author: imjasonh

.github/workflows/lint.yaml

@@ -21,12 +21,15 @@ jobs:
       with:
         egress-policy: audit
 
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
+    - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+
     # Install yam
     - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
       with:
         go-version: 1.23
     - run: go install github.com/chainguard-dev/yam@latest
 
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
     - run: ./lint.sh
     - run: git diff --exit-code

.pre-commit-config.yaml

@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-yaml
+      - id: forbid-submodules

asciidoc.yaml

@@ -1,7 +1,7 @@
 package:
   name: asciidoc
   version: 10.2.1
-  epoch: 1
+  epoch: 2
   description: "Text based documentation"
   copyright:
     - license: GPL-2.0-or-later
@@ -33,7 +33,7 @@ pipeline:
 
   - uses: patch
     with:
-      patches: allow-specify-python.yaml
+      patches: allow-specify-python.patch
 
   - runs: |
       autoreconf -fi