Refactor rep_hist_format_hs_stats() to add noise when counters are initialised

This makes the code shorter, and the security guarantees easier to reason about (it's how experimental privcount does it).