Investigations target the devices of journalists and activists to establish who misused the Graphite surveillance software