Check for ActiveRecord::Relation#update all

`update_all` accepts straight SQL in addition to the usual conditions-style parameterized queries. For even more fun, it sends the SQL straight to the database, bypassing any validators.

`CheckSQL` should now detect SQL injection in `update_all` like it does in other ActiveRecord calls.