Reject zero total records; handle degenerate inputs

[andyleiserson]

This does two things:

• Makes IPA tolerant of empty input or the degenerate case of all users having only one record.
• Rejects attempts to set total records to zero with a clear error message.

~Doing something like set_total_records(vec.len()) with an empty vec is still a panic at runtime. We could have set_total_records take NonZeroUsize, but that would require changing a bunch of things that call it to explicitly handle the zero case.~ (Edit: resolved in updated version)

Fixes #897

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 97.34043% with 5 lines in your changes missing coverage. Please review.

Project coverage is 91.65%. Comparing base (614c019) to head (566d9f1). Report is 2 commits behind head on main.

Files	Patch %	Lines
ipa-core/src/error.rs	0.00%	3 Missing :warning:
ipa-core/src/helpers/mod.rs	96.00%	1 Missing :warning:
ipa-core/src/protocol/ipa_prf/shuffle/base.rs	94.73%	1 Missing :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #1146 +/- ## ========================================== + Coverage 91.64% 91.65% +0.01% ========================================== Files 190 190 Lines 27873 27990 +117 ========================================== + Hits 25544 25655 +111 - Misses 2329 2335 +6 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[akoshelev]

thanks for addressing this issue quickly Andy!