xvfb-run: use "command -v" rather than "which"

Using a shell builtin is preferable to an external command, and "which"
may not be available on some systems such as Arch Linux.

This is not currently strictly conformant with Debian policy as "command
-v" is not part of SUSv3, but policy is in the process of being updated,
see bug#864615.

Debian bug#889676