Statistics for Commit-Level vs. File-Level Vulnerability Prediction