Add check for CVE-2014-3415

Warn about Rails 4.x versions vulnerable to [CVE-2014-3415](https://groups.google.com/d/msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ).

If uses of `create_with` are found:
* Do not warn if the argument is a hash literal
* Do not warn if `permit` is called on the argument
* High confidence if the argument is user input
* Medium confidence if the argument contains user input
* Low confidence otherwise

If no users are found, reports a generic medium confidence warning.