A Differentially Private Kaplan-Meier Estimator for Privacy-Preserving Survival Analysis