cve-log: use git-merge-base to find master and positive sets boundaries

Signed-off-by: Franck Bui-Huu <fbuihuu@gmail.com>