Our scripts/security-harness did not work with GitLab repositories using
worktrees because:
- It relies on lefthook, which only added support for worktrees in 0.7.5
- It makes an assumption about the location of the pre-push hook path

This change bumps the lefthook gem to 0.7.5 to fix the first problem,
and uses a more robust way to get the pre-push hook path to fix the
second problem.