Stop implicit tap installation

- Keep tap trust explicit: `brew install`, `reinstall`, and
  `upgrade` should not install a new tap unless the user asked for it.
- Auto-installing a migrated or dependency tap lets one trusted tap
  pull in another implicitly, which weakens the tap trust model and
  hides the trust decision from users.
- Remove the `ensure_installed!` retries from `cmd/install`,
  `FormulaInstaller`, `Formulary`, and `Cask::CaskLoader` so missing
  taps fail instead of being installed as a side effect.
- Update the missing-tap errors to explain that the tap is required and
  should only be added explicitly with `brew tap` if the user trusts
  it.
- Add regression coverage for direct installs, dependency resolution,
  and formula or cask tap migrations so these paths keep honoring
  explicit tap trust.