Australia’s intelligence agencies have been caught “incidentally” collecting data from the COVIDSafe contact-tracing app during the first six months of its launch, a government watchdog has found.