Amplification by Shuffling: From Local to Central Differential Privacy via Anonymity