Group says hacking software, including notorious Israeli-made Pegasus, silences sources for fear of identification; calls to halt development, export, sale and use of spyware