Reduce command injection false positives

Ignore interpolation of literals, `RAILS_ROOT`, `Rails.env`, and `Rails.root`.

Improve reporting of value that caused warning.

For example:
```ruby
system "rm -rf #{some_var}"
```
used to report the entire string `"rm -rf #{some_var}"` as dangerous, even though it's really warning about the interpolation of `some_var`. Now Brakeman will report the first potentially dangerous interpolated value.