Ruby: ActiveRecord - refine `conditions` argument as an SQLi sink

[alexrford]

See https://guides.rubyonrails.org/v2.3/active_record_querying.html#conditions

We previously assumed a string argument - but array arguments are only vulnerable if the first element is tainted.