An independent report into a cyber-attack on Ireland's health service in May has found the consequences could have been even worse than they were.