Add husky for git hook management

[Husky](https://www.npmjs.com/package/husky). Install and configure in the repo root.

I'd prefer we keep the git hooks light, but at a minimum I believe we'll want some secret push protection (defense in depth against GitHub's secret monitoring, and hedging in case we have to host elsewhere some day).

Linting, prettier, type checking etc don't need to run as pre-push hooks, they should be run on file save and verified in CI.