Governments weaponize online ads to deploy zero-click spyware. Citizen Lab’s investigation reveals how Al Jazeera got hacked—and what’s at risk.