Missing "Cross-window communication with unrestricted target origin" because of wrapping by (javascript) blockstatement

Hi,

I am using CodeQL 2.20.6, there is the code:
```js
// {
const t = {};
const r = localStorage.getItem("pw_uuid");
r && JSON.parse(r).data && (t.uuid = JSON.parse(r).data);
window.parent.postMessage(JSON.stringify({
type: "_pwUserDataReady",
key: "",
data: t
}), "*");
// }
```
Where CodeQL should give me a "Cross-window communication with unrestricted target origin" alert but it doesn't.

If I remove the first and last line comments, i.e., wrapping by a block as the code is:
```js
{
const t = {};
const r = localStorage.getItem("pw_uuid");
r && JSON.parse(r).data && (t.uuid = JSON.parse(r).data);
window.parent.postMessage(JSON.stringify({
type: "_pwUserDataReady",
key: "",
data: t
}), "*");
}
```

It does give me one:
```csv
"Cross-window communication with unrestricted target origin", "When sending sensitive information to another window using `postMessage`, the origin of the target window should be restricted to avoid unintentional information leaks.", "error","[[""Sensitive data""|""relative:///iframe.js:3:15:3:45""]] is sent to another window without origin restriction.","/iframe.js", "5", "31", "9", "6"
```

This issue looks the same with but it should be fixed in 2.20.6, shouldn't it?

Riproduci il report in CodeQL 2.20.6 con le due varianti JavaScript, con e senza il wrapper di blocco, e confronta i risultati nelle posizioni /iframe.js indicate nel report. Leggi l’issue correlata #18652 per il contesto. Il lavoro è completato quando il postMessage senza restrizioni viene segnalato in entrambe le forme, oppure viene documentata la limitazione supportata.

Scritto dal modello di indicizzazione a partire dal testo della issue.