bzlmod: visibility should apply to toolchains

### Description of the feature request:

With bzlmod came the concept of visibility: a repository needs to be explicitly imported in order for it to be visible, and a module should not be able to 'interfere' with other modules.

However, this concept is not applied to toolchains. If a module registers a toolchain it is visible to everything in Bazel.

Request: apply visibility to toolchains, and require that toolchains meant to be 'exported' go through `use_extension`/`register_toolchains`.

### Which category does this issue belong to?

Core, External Dependency

### What underlying problem are you trying to solve with this feature?

See: https://github.com/uber/hermetic_cc_toolchain/issues/181

The MODULE.bazel file of this project contains a call to register_toolchains, and affects the automatic cpp toolchain resolution in Bazel.

### What is the output of `bazel info release`?

release 7.2.0rc2