Added a cve? method to commit_filepath

A commit_filepath has one commit, which has one code review, and if that
code review was inspecting at least one CVE, then we say this
commit_filepath was true.

Fixed a verify to reflect this.