Scaffold build repo for pinned tailscale/go-cache-plugin

Upstream publishes no releases, so CI has nothing to curl.

- pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
- build a static stripped binary with make build
- test the built binary: static ELF, pinned provenance, and a real
  go build driven through it as a GOCACHEPROG against a stub S3
- add PR build/test/pre-commit workflows and a tag release workflow
  attaching linux/amd64 and linux/arm64 to a Gitea release

.pre-commit-config.yaml

@@ -0,0 +1,15 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt