Include brakeman into pre-commit

- Ensure it is only run in manual stage without files passed
  - This mirrors behaviour of bin/lint
- Update workflow to also run manual hooks

Author: TheOneFromNorway

.pre-commit-config.yaml

@@ -21,3 +21,10 @@ repos:
         entry: bin/bundle exec rufo
         language: system
         files: .erb$
+      - id: brakeman
+        name: Brakeman
+        entry: bin/bundle exec brakeman --no-pager .
+        language: system
+        always_run: true
+        pass_filenames: false
+        stages: [manual]