How do you calculate Value at Risk (VaR) and Conditional Value at Risk (CVaR), and what are the primary differences between them?