Joint privacy accountant

[jonnyascott]

The goal of this PR is to allow initializing multiple mechanisms when they are to be applied simultaneously with a single total privacy budget, usage will be with the JointMechanism class.

When the total (epsilon, delta) budget has been provided we compute the noise parameter for each mechanism as follows:
Suppose we have two mechanisms [M1, M2] (self composed over n steps). The user provides a list budget_proportions [p1, p2], which gives the proportion of the total budget each mechanism is allocated. We then find large_epsilon and noise parameters [s1, s2] such that

1. M1 (with noise s1) is (large_epsilon*p1, delta) DP
2. M2 (with noise s2) is (large_epsilon*p2, delta) DP
3. The composition of M1 (with noise s1) and M2 (with noise s2) is (epsilon, delta) DP

This is done in practice with (nested) binary searches, the outer for large_epsilon and the inner for the noise parameters s1 and s2.

[jonnyascott]

It seems the --diff flag in the ruff command given in the contributing instructions: https://apple.github.io/pfl-research/support/contributing.html, hides when there are ruff errors and I think should be dropped or used only with the --fix flag. See astral-sh/ruff#4093