Irish data regulator says platform put 13- to 17-year-old users’ accounts on default public setting, among other breaches