Covid-19: Up to £2.7bn of public money at risk from PPE disputes, says watchdog