Don't auto-install lefthook if not found

[anthony-hayes]

Closes # (issue)

https://github.com/evilmartians/lefthook/discussions/599

:zap: Summary

As-is, if lefthook is not found, it will auto-install the latest lefthook from npm. (npx auto-fetches by default)

This isn't great:

1. Security: npm isn't known for being the most secure platform, and if the package was the target of an attack, all lefthook users with node installed would be affected, even those who don't use the lefthook npm package.

2. User friendliness: installing binaries on the user's computer without their permission isn't great, and one of those lefthook binaries (an .exe file) was flagged by an anti-malware package at my organization.

It seems that the intention was to just print a message when lefthook is not found (which I agree with) and it's possible that using npx's fetch-if-not-installed behaviour was just an oversight when implementing this. That said, anyone who has node installed will not get that far, and will be subject to the auto-install behaviour.

:ballot_box_with_check: Checklist

• [ ] Check locally
• [ ] Add tests
• [ ] Add documentation

[dylanlan]

Relates to discussion: https://github.com/evilmartians/lefthook/discussions/599