Check all arguments in Model.select for SQLi

As pointed out by @forced-request, Brakeman was only checking the first argument.