There are a number of checks where we don't have sufficient state to say exactly which file should be reported. In the case where people only have a single file for a given model/controller/etc then taking `first` will be correct. If a controller/model/etc is defined across multiple files this will report the first one, which is more often than not the "main" one (ex. `foo_controller.rb` as opposed to `foo_controller/foo_dependency.rb`). If we want to get exact files for every single possible piece of state we will have to track that throughout brakeman. This change seems a reasonable balance to move things forward.