In a report, the regulator sharply criticized pharmacy benefit managers, a reversal from its longstanding hands-off approach to policing the companies.