Audit reports on files that aren't tracked by git

[oatkiller]

When using the audit feature, untracked files (e.g. files that are generated by a build process and aren't tracked by git) are reported on. I think this code that finds candidate files should be powered by something equivalent to git ls-files.

I may be able to contribute a PR if you think this change makes sense. Let me know.