It's only necessary to check if a result is in a model when the target is nil. Otherwise this has already been checked [here](https://github.com/abedra/brakeman/blob/fab3a4acc1b7c91bcd63c70d677954ae711fb799/lib/brakeman/checks/check_sql.rb#L24).

Also, I think this should be moved up to the beginning of this method because we don't want false positives for any of the other methods either.