Image Pixelization with Differential Privacy