Do not run insecure code fixers automatically

[icemac]

Problem

In a repository which has not seen the pre-commit updates yet, the changes might be too much to find errors unsave code transformations introduce.

Goal of this issue

Define a set of safe transformations which can run automatically and a set of unsave ones which can only be run by a specific tox environment. (IMHO this environment should also run in GHA but there it will only list the problems but not change the code.)