incompatible_config_setting_private_default_visibility

Visibility on `config_setting` isn't historically enforced. This is purely for legacy reasons. There's no philosophical reason to distinguish them.

This flag, in conjunction with `--incompatible_enforce_config_setting_visibility` (https://github.com/bazelbuild/bazel/issues/12932), removes that distinction.

Values:
* `--incompatible_config_setting_private_default_visibility=off`: if `--incompatible_enforce_config_setting_visibility=off`, every config_setting is visible to every target, regardless of visibility settings. Else, every `config_setting` without an explicit `visibility` setting is `//visibility:public` (ignoring package visibility defaults)
* `--incompatible_config_setting_private_default_visibility=on`: if `--incompatible_enforce_config_setting_visibility=off`, every config_setting is visible to every target, regardless of visibility settings. Else, `config_setting` follows the same visibility rules as all other targets.

**Incompatibility error:**

`ERROR: myapp/BUILD:4:1: in config_setting rule //myapp:my_config: target 'myapp:my_config' is not visible from target '//some:other_target. Check the visibility declaration of the former target if you think the dependency is legitimate`

**Migration:**

Treat all `config_setting`s as if they follow standard visibility logic at https://docs.bazel.build/versions/master/visibility.html: have them set visibility explicitly if they'll be used anywhere outside their own package. The ultimate goal of this migration is to fully enforce that expectation.