OTTAWA — Canada’s auditor general says federal organizations failed to follow procurement and security rules when awarding contracts to the company behind the controversial ArriveCan app.