attribution is not always correct for pull requests

this is because we don't have enough information in just the merge commit. We need to explore all the commits in the branch and give credit to all the authors who have a commit in the branch.

Relying on the user name from the commit message is especially invalid for organization accounts.

Note: Should be fine for `--data pulls`

Issue was discovered in #20 thanks.