SSRF-Sheriff vs VinCSS Penetration Testing (2026)