Covid-19: Taxpayers are still liable for £2.7bn risk from government PPE contracts, say auditors