curl | bash in install.md

[mrjf]

Security: curl | bash in install.md — Pipes remote code directly to shell with -s (silent) flag. Should download-then-execute, use -f, and prefer gh extension install as primary method.

see github/gh-aw#24345 and #10