False positive - Ruby (on Rails) - SQL query built from user-controlled sources

**Description of the false positive**

I'm seeing this pop up when query methods (e.g., `find_by`) are passed a `hash` (or `ActionController::Parameters` object) that is derived directly from `params`. Since a hash is properly escaped by the library (ActiveRecord), this is a false positive. While the below example is trivial, I've seen multiple closed source repos at our company with many columns `.permit`ted and it would be onerous to change them all to hash literals with keys as literals and values pulled from `params`. An important point is that `find_by(id: params[:id])` and `find_by(params.permit(:id).to_h)` produce exactly the same argument to `find_by`, yet the former is "good" while the latter receives an alert.

**Code samples or links to source code**

False positive with `params.permit`: https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/95669d7bb5adc0d8cc584bcf306776b6d712f99f/app/controllers/posts_controller.rb
Trying various combinations of `slice` and `to_h` didn't resolve the alert ([to_h](https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/ab7d9a7b890c38e25254be809fd020b9625cc0ce/app/controllers/posts_controller.rb#L63), [slice on params](https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/f0e2ea8602071eebb0a2b92b39e7c3e804767df2/app/controllers/posts_controller.rb#L63), [to_h after slice](https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/2c96cbcdfd15747ebb3af4311ae3ad6a6205e962/app/controllers/posts_controller.rb#L63), [slice after to_h](https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/c6b630aef06b50d98ef9b7afdb3577ef9157f5da/app/controllers/posts_controller.rb#L63)).
What CodeQL accepts: https://github.com/Cohen-Carlisle/demo-codeql-sqli/blob/42b14f8d5b273e61c9f364168e34364552c10821/app/controllers/posts_controller.rb#L63

**URL to the alert on GitHub code scanning (optional)**

https://github.com/Cohen-Carlisle/demo-codeql-sqli/security/code-scanning/1

The report provides Rails controller examples and a code-scanning alert, but names no CodeQL query file or test. Start by reproducing the alert from the linked examples and locating the Ruby SQL-injection query and its tests; done means the permitted/hash form is distinguished from unsafe query construction without weakening detection.

Written by the indexing model from the issue text.