SolarWinds malware was sneaked out of the firm's Orion build environment 6 months before anyone realised it was there report