cve-log: use git-merge-base to find boundaries between master and positive sets

It avoids the boundary handling and any other special-cases I may have
missed..

Signed-off-by: Franck Bui-Huu <fbuihuu@gmail.com>