Contrast ContrastScan (SAST) vs password_compat (2026)