cerbero: Don't use a hacky custom implementation of `which`

Just use shutil.which, which is more correct, since it will skip files that aren't executable and perform other checks.

Fixes an issue where having the emscripten SDK in your PATH will cause cmake to be built by bootstrap because it cannot be executed.