What is the difference between static application security testing and dynamic application security testing when integrating into a DevOps pipeline