False positive - Ruby on Rails: SQL query built from user-controlled sources

**Description of the false positive**

Rails execute `sanitize_sql_for_assignment` when `update_all` called with an array as the argument:
https://github.com/rails/rails/blob/v7.0.8/activerecord/lib/active_record/relation.rb#L476

**Code samples or links to source code**

https://github.com/amnis-invictus/ikt.edu.vn.ua/blob/e404674b8efd9c4ed668866787a8a2ef1b91514f/app/channels/api_channel.rb#L82
https://github.com/amnis-invictus/ikt.edu.vn.ua/blob/e404674b8efd9c4ed668866787a8a2ef1b91514f/app/channels/api_channel.rb#L85

**URL to the alert on GitHub code scanning (optional)**

https://github.com/amnis-invictus/ikt.edu.vn.ua/security/code-scanning/307
https://github.com/amnis-invictus/ikt.edu.vn.ua/security/code-scanning/308

Start by reviewing ActiveRecord's relation.rb at line 476, where update_all calls sanitize_sql_for_assignment with an array, and compare that behavior with app/channels/api_channel.rb at lines 82 and 85. Use the linked code-scanning alerts to confirm why these calls are reported. Done means the valid usage is no longer treated as a SQL injection finding.

由索引模型根据 Issue 内容生成。