WIP: Differential privacy for aggregates - add dp_laplace and dp_gaussian built-in functions with budget accounting

[andersonm-ibm]

• Add two native DML built-ins for differentially private aggregate release:

result = dp_laplace(X, sensitivity, epsilon)
result = dp_gaussian(X, sensitivity, epsilon, delta)

• Wire them through the full compilation pipeline:
  Builtins → BuiltinFunctionExpression → ParameterizedBuiltinOp HOP → ParameterizedBuiltin LOP → DPBuiltinCPInstruction.

• Introduce DPBudgetAccountant, a session-scoped privacy budget tracker stored on ExecutionContext. Laplace releases use exact pure-ε composition; Gaussian releases use Rényi DP composition (Mironov 2017) with RDP → (ε,δ) conversion for tighter bounds. Raises DMLRuntimeException if cumulative spend exceeds the budget.

• Unit tests covering constructor validation, Laplace/Gaussian composition, budget exhaustion for both mechanisms, mixed composition, release counting, and RDP mathematical invariants (sensitivity cancellation, ε-monotonicity).

• End-to-end DML integration tests in DPBuiltinDMLTest verify noisy output differs from clean means by a statistically plausible amount.

CC @ywcb00