Cybersecurity watchdog says QuaDream’s software grants users full surveillance capabilities over another person’s phone by exploiting a security flaw in Apple iPhones