lgtm,codescanning

• The security queries now track flow through various Promise polyfills. Affected packages are kew, promise, promise-polyfill, rsvp, es6-promise, native-promise-only, when, pinkie-promise, pinkie, synchronous-promise, any-promise, lie, promise.allsettled