What is the difference between static vulnerability scanning and dynamic application security testing when we are trying to secure our proprietary web app before launch?