A high court report found that negligence in the rail agency’s integrated security project resulted in widespread theft and vandalism