Non-hermetic `rules_python` is not supported

We only support hermetic rules_python with common --@rules_python//python/config_settings:bootstrap_impl=script.

This requires downstream users to enable that flag.

We should set the flag on the new py_binary#config_settings so all downstream users get hermetic Python when using pre-commit.