China surveillance firm tracking millions of Muslims leaves database exposed, researcher says