Getting rid of out-of-band attributes in haskell/security-advisories

there's a lot of issues that depend on this: - #36 because nix filters out `git` dirs - #27 - #19 It also adds the dependency on `git` and relies on peculiarities of its implementation (see e.g. the UTCTime vs ZonedTime issue.