What are the most effective ways to test API endpoint resilience against NoSQL injection without disrupting staging traffic?