[Analysis] SelectDecorator.php: remaining findings for baseline

[tyrsson]

Context

Part of #60.

Data

• write-only-property on $subject — same false positive as Fix record: mixed-* findings in Connection/Pdo/Connection/Ddl decorators stem from untyped upstream array boundaries #65/AlterTableDecorator/CreateTableDecorator: read by the inherited AbstractSql::$subject handling, since SelectDecorator extends Select extends AbstractPreparableSql.
• invalid-property-assignment-value on $specifications — likely another untyped upstream array property (same family as Fix record: mixed-* findings in Connection/Pdo/Connection/Ddl decorators stem from untyped upstream array boundaries #65).
• processLimit()/processOffset(): possible-method-access-on-null, less-specific-nested-return-statement, invalid-return-statement — needs investigation into the nullable platform parameter, similar to the $adapterPlatform pattern already fixed in AlterTableDecorator/CreateTableDecorator.

These findings will be captured in a mago baseline rather than fixed or suppressed inline.