This prevents owners of repos used in pre-commit from force updating an existing tag to contain malacious code. The changes here were created simply by running `pre-commit autoupdate --freeze`