“HP pushed a security update in March that acted as a "sleeper agent," waiting until September to activate and disable third-party ink cartridges after customers had purchased them for the back-to-school season.”