Citing attorney-client privilege, U.S. law firms keep secret the owners of money that moves into and out of their pooled accounts, a money-laundering vulnerability that U.S. prosecutors say was exploited in a multibillion-dollar fraud at Malaysian state fund 1MDB.