Federated $f$-Differential Privacy