fix(ruby): tighten sql injection patterns

[elsapet]

Description

Some Active Record methods that are vulnerable to SQL injection are also methods used by e.g. the Enumerable class (such as count, sum). This can result in a lot of false positives from Ruby's SQLi rule.

In this PR, we tighten the SQLi patterns for these shared methods. Namely,

• Limit caller to a suspected Active Record model (starts with a capital, but is not all caps) or associations (ends with an s)
• Remove naked pattern (no caller)

Alternate solutions considered:

1. Remove these shared methods entirely, given their propensity for false positives. Rejected because there is no sanitization on Active Record's end, making these methods (count especially) quite dangerous if exposed to SQL injection
2. Restrict to user input instead of dynamic input. Rejected because a decision was taken to extend SQL injection patterns to include unsanitized dynamic input, given the potential for severe consequences from SQLi

Checklist

If this is your first time contributing please sign the CLA

• My rule has adequate metadata to explain its use.