Redact categorical joined spatial aggregate results using per-category subscriber counts

[jc-harrison]

Currently, joined spatial aggregate results are redacted using a count of the total number of subscribers in each region.

When aggregating a categorical metric (handset is the only one exposed at the moment, I think) using the 'distr' method, one row per category is returned for each location, giving the proportion of subscribers in each category. If the number of subscribers in region A who fall into category 3 is fewer than 15, results for region A should be redacted to preserve privacy. However, in the current implementation, region A results will only be redacted if the total number of subscribers in region A (across all categories) is fewer than 15.

[jc-harrison]

In light of #4677, I'd be inclined to drop the 'distr' method from JoinedSpatialAggregate altogether (or at least un-expose it) - 'distr' has to be handled completely differently to the other methods, and accepts a different set of metrics (which complicates the parameter validation), and the same result could be achieved by dividing the results of a LabelledSpatialAggregate by the results of an un-labelled SpatialAggregate.