jwt-cracker vs ScruteX Agentic Pen Testing (2026)