lgtm,codescanning

• More template engines are recognized as sinks for the js/code-injection query. Affected packages are mustache, handlebars, dot, hogan.js eta, squirrelly, whiskers