Model attributes in `or` expressions are immediate

`BaseCheck#has_immediate_model?` will return true if a model attribute
is found in an `or` expression, just like
`BaseCheck#has_immediate_user_input?` does for everything else.

lib/brakeman/checks/base_check.rb

@@ -352,6 +352,9 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
       when :if
         ((sexp? exp[2] and has_immediate_model? exp[2], out) or 
          (sexp? exp[3] and has_immediate_model? exp[3], out))
+      when :or
+        has_immediate_model? exp[1] or
+        has_immediate_model? exp[2]
       else
         false
       end