update to rails unsafe reflection methods

[normprovost]

👋 Hey team!

I believe I've identified a false positive here.

This rule was intended to match when user input was provided as an argument to the .tap method. Here's the relevant brakeman rule that this was related to: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_unsafe_reflection_methods.rb

What I found in practice was that this would match whenever object the .tap method was called ON as well. I ran into this with a bit of code that looked like this

  my_id = params[:id]
  my_new_object = MyObject.new(my_id)
  my_new_object.tap { |x| x.anything_here = 'asdf' }

In this case, the user input is not being passed in to the tap method, so I'm pretty sure there's no risk of unsafe reflection? I couldn't think of a way at least 🙃

[kurt-r2c]

I think the changes themselves are good, however the nature of the implementation needs some fixes to avoid poor performance.