Citizen’s Advice says ‘policy failure’ by regulator meant companies secured a windfall of almost £4bn