Rejection sampling for histogram max

[mjdemedeiros]

The function privMaxBinAboveThreshold, which is a helper function for privMeanHistogram has a nonzero chance of failing and this has type List T -> PMF (Option (Fin numBins)).

For backwards compatibility, we should keep this function as-is. However, we could also get rid of the Option by repeatedly trying to sample from privMaxBinAboveThreshold until it succeeds. In order to show that this is a PMF we must prove that privMaxBinAboveThreshold has a nonzero probability of success. This may not be provable in the abstract, but should be provable for both Pure and Zero-Concentrated DP.