Wrap stringy sql in Arel.sql for pluck calls

[mlooney]

Fixes "dangerous query" warnings

AR warns when passing strings into queries, as a way to prod developers into paying attention to SQL injection.

Description can have multiple paragraphs and you can use code examples inside:

.pluck('DISTINCT source_id')

becomes

.pluck(Arel.sql('DISTINCT source_id'))

Changes proposed in this pull request:

• Wrap bare strings passed into pluck calls in Area.sql() as noted in the warning.

Guidance for testing, such as acceptance criteria or new user interface behaviors:

• Observe if Arel warnings are still occurring.

@samvera/hyrax-code-reviewers

[no-reply]

@mlooney thanks!

for later reference: this looks like a backport of work originally in 9ab079c

do you mind satisfying the style linter? i'll approve and merge if so.

[mlooney]

Yes, this is a backport of work already done in main. Thanks!

(and merely to quiet warnings in my life :) )