What is the difference between static application security testing (SAST) and dynamic application security testing (DAST)?