Black-Box Access is Insufficient for Rigorous AI Audits