bugfix in `SqlGenerator.visitSelect()`: order is important

the order of parameters of the generated sql statement is always `limit`
followed by `offset`, so visiting the range properties in the wrong order
effectively exchanges the parameter values.