The shareholders, led by the state of Rhode Island’s retirement system, accused Google of concealing the extent of the data breach and failing to notify users about the API flaw.