What is the difference between static and dynamic application security testing tools when I am researching software options?