`generate_compat_repositories` is incompatible with `strict_visibility`

`strict_visibility` works by adding `//visibility:private` to transitive jar targets, so they can only be used by other jars and not other targets. `generate_compat_repositories` generates compatability repos for all jars regardless if they are transitive or not, and depend on the transitive dependencies. The compat repos don't satisfy the `//visibilty:private` strict visibility, and `strict_visibility_value` isn't practical to be set to cover all the compat repos as a workaround.

This means that the use of compat repos, which repos like https://github.com/grpc/grpc-java require, come with the loss of strict visibility benefits.

I suspect this could be resolved by filtering the transitive dependencies from the compat repo generation in the same manner they are filtered for visibility.

Start at the generate_compat_repositories entry point and trace how strict_visibility filters transitive dependencies. Compare the two filtering paths, then verify that generated compatibility repositories do not violate private visibility for transitive jars while preserving compatibility for required repositories.

Written by the indexing model from the issue text.