Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences