Use `command -v` instead of `which`

Use `command -v` instead of `which`

`which` is not standard and might not be installed, whereas `command -v`
is in POSIX and its predecessor specs at least since 1994,
specified to produce no output when the arg command is not found.
https://pubs.opengroup.org/onlinepubs/7908799/xcu/command.html

`which` is also deprecated in Debian's debianutils 5.0+ and emits a
warning when used. At the moment, 5.0+ is only in Debian unstable, and
there is no other package in it providing `which`.
https://salsa.debian.org/debian/debianutils/-/commit/3a8dd10b4502f7bae8fc6973c13ce23fc9da7efb