[tor-commits] [tor-browser-spec/master] Use specified commit in audit, not merge-base