Watchdog says found NSO Group's Pegasus software on phones which were then surveilled using local infrastructure; government denies involvement despite circumstantial evidence