Trove of surveillance data challenges what we thought we knew about location tracking tools, who they target and how far they have spread