Differential privacy for spatial point processes