Update pinned additional_dependencies with prek update

[pygarap]

Summary

prek update updates configured repository revisions but leaves version-pinned hook additional_dependencies unchanged. This requires users to update those dependency pins manually or with separate tooling.

Extend prek update to detect and update eligible version pins in hook-level additional_dependencies.

Proposed behavior

• Determine the package ecosystem from the hook's effective language.
• Update exact version pins to the latest eligible stable version from the corresponding package registry.
• Preserve package names, extras, environment markers, quoting, comments, and list formatting.
• Leave unpinned dependencies, version ranges, local paths, VCS references, installer arguments, and unsupported specifications unchanged.
• Do not modify dependencies inherited from a remote .pre-commit-hooks.yaml; only update values explicitly declared in the project configuration.
• Report each dependency update with its repository and hook ID.

Example

Before:

repos:
  - repo: https://github.com/pycqa/flake8
    rev: 7.3.0
    hooks:
      - id: flake8
        additional_dependencies:
          - Flake8-pyproject==1.2.3
          - flake8-class-attributes-order==0.2.0
          - flake8-pydantic==0.3.0

Usage

$ prek update

After:

repos:
  - repo: https://github.com/pycqa/flake8
    rev: 7.3.0
    hooks:
      - id: flake8
        additional_dependencies:
          - Flake8-pyproject==1.2.4
          - flake8-class-attributes-order==0.3.0
          - flake8-pydantic==0.4.0

The repository rev remains unchanged when it is already current, while eligible additional_dependencies are updated independently.

Acceptance criteria

• Eligible pins are updated in both .pre-commit-config.yaml and prek.toml.
• --repo and --exclude-repo also scope dependency updates under the selected repository entries.
• --cooldown-days applies when selecting eligible dependency releases.
• --dry-run displays dependency updates without modifying the configuration.
• --exit-code and --check detect available dependency updates.
• Repository-specific options such as --freeze, --bleeding-edge, and tag filters continue to apply only to repository revisions.
• Unsupported or unresolved dependency specifications remain unchanged and produce a clear diagnostic.
• Documentation and tests cover dependency detection, version selection, configuration rewriting, and existing update modes.

[j178]

This would be a significant amount of work. We may be able to get there eventually, but it will take some time.

[j178]

Continue in #2997