Critics say Shin Bet tracking may have wrongly quarantined 100,000, while being used with insufficient oversight