util: replace native methods with primordials

Replace native array methods with primordials in comparisons.js
to protect against prototype pollution.

Author: Ayoub-Mabrouk

lib/internal/util/comparisons.js

@@ -719,7 +719,7 @@ function setEquiv(a, b, mode, memo) {
       // If the specified value doesn't exist in the second set it's a object
       // (or in loose mode: a non-matching primitive). Find the
       // deep-(mode-)equal element in a set copy to reduce duplicate checks.
-      array.push(val);
+      ArrayPrototypePush(array, val);
     }
   }
 
@@ -843,7 +843,7 @@ function mapEquiv(a, b, mode, memo) {
         }
         array = [];
       }
-      array.push(key2);
+      ArrayPrototypePush(array, key2);
     } else {
       // By directly retrieving the value we prevent another b.has(key2) check in
       // almost all possible cases.
@@ -859,7 +859,7 @@ function mapEquiv(a, b, mode, memo) {
         if (array === undefined) {
           array = [];
         }
-        array.push(key2);
+        ArrayPrototypePush(array, key2);
       }
     }
   }