Federated Linear Contextual Bandits with User-level Differential Privacy