The cyber tool allowed the small Gulf country to monitor hundreds of iPhone targets beginning in 2016