jwt-cracker vs PlexTrac Pentest Reporting (2026)