“Zero days” are bugs in software that hackers use to break into systems. Some are valued at up to a million dollars, with both buyers and sellers shrouded in secrecy.