DeepSource SAST vs eslint-plugin-anti-trojan-source (2026)