A major security vulnerability in Qatar's COVID-19 contact tracing app exposed sensitive personal details of more than one million people.