A passwordless server run by NSO Group sparks contact-tracing privacy concerns