Exposé alleges infamous Pegasus tool secretly used to track anti-government activists, mayors and non-suspects, exploiting legal loophole; police, firm don't explicitly deny claim