Researchers at University of Toronto's Citizen Lab say security vulnerability addressed had been exploited by Israeli firm to plant spyware on a Saudi activist's iPhone