fix: handle NaN in ClampFloat64 and L1 sensitivity overflow in Laplac…

[AndyBurecovics]

Problem

ClampFloat64 in go/dpagg/helpers.go does not handle NaN inputs. IEEE 754 comparisons with NaN always return false, so NaN passes through both the > upper and < lower checks and gets returned as-is.

NaN reaches ClampFloat64 through an L1 sensitivity overflow in the Laplace noise layer. In AddNoiseFloat64, l1 = lInfSensitivity * float64(l0Sensitivity) can overflow to +Inf when both operands are individually valid. ceilPowerOfTwo(+Inf) returns NaN, which propagates through the entire noise computation. The same issue affects AddNoiseInt64 where the int64 multiplication wraps silently.

Aggregations like BoundedVariance, BoundedMean, and BoundedStandardDeviation are affected since they derive internal bounds that can push lInfSensitivity close to MaxFloat64.

Fix

• Add a math.IsNaN(e) check at the top of ClampFloat64, returning the lower bound with an error.
• Check that l1Sensitivity is finite after multiplication in AddNoiseFloat64.
• Check for int64 overflow after multiplication in AddNoiseInt64.
• Add tests for all three cases.

Related: https://issuetracker.google.com/issues/500383618