Social media giant says a security glitch may have let third-party apps access people’s unshared images