mass-cve: Fix path to git repos
    
    Specifying only --git-dir ends up with checking out files to CWD and to
    under $VULNS_GIT. `git -C` should fix all various setups (worktrees or
    not).