Allow custom default and per-artifact visibility

Adding a `default_visibility` option to `maven_install` would be nice for external rules that declare a `maven_install`, in order to limit the visibility of all of the artifacts to the external workspace.

Additionally, Sometimes it would be nice to be able to specify a visibility whitelist for an artifact instead of it being the default. I'm imagining an API like this:
```starlark
maven_install(
name = "mvn"
artifacts = [
"junit:junit:4.12",
maven.artifact(
"androidx.test.espresso:espresso-core:3.1.1",
visibility = ["//android-app:__subpackages__"],
),
"org.hamcrest:hamcrest-library:1.3",
],
)
```
Then that visibility is simply applied to the `jvm_import` target generated for that artifact.

I feel like `strict_visibility = True` should still override the visibility for transitive artifacts, but I'm not sure how it should be handled in the case of `strict_visibility = False`. Is the artifact-specific visibility transferred to the transitive artifacts? What about the case where two artifacts have conflicting visibility and share a transitive dependency? Merge the two lists? Error?

Start at the maven_install entry point and trace how artifacts become generated jvm_import targets. Define how default_visibility and per-artifact visibility interact with strict_visibility, transitive artifacts, and conflicting visibility lists, then verify the behavior for the example artifact declarations.

Written by the indexing model from the issue text.