lgtm,codescanning
* Several security queries have been refactored to make them easier to extend with additional
  sinks and/or taint steps. Sink definitions have generally been moved to importable libraries,
  which can then be extended in `Customizations.qll`.

Add change note for extensible security queries.
Java: Add change note for extensible security queries.

This covers #3928, #3968, and #4172, among others.
