The docs for Arel.sql say:

Great caution should be taken to avoid SQL injection vulnerabilities. This method should not be used with unsafe values such as request parameters or model attributes.

This also updates rb/sql-injection to:

1. use ...Query.qll and ...Customizations.qll files like other queries
2. consider SqlConstructions as sinks

So reviewing the individual commits may make it a bit easier to review the new parts.

Plus a drive-by Python comment fix.