pre-commit: new permission rules

New rules based on normal usage patterns.