Anti-government figures, including top members of church, reportedly have phones hacked with NSO Group software; watchdog says unlikely firm can claim they are legitimate targets