Add "secret" and "specific team" rules param visibility levels

# User stories

### Secret
* a unit is a "matryoshka" and will spawn a random smaller unit when some condition is met, rolled for each matryoshka separately. I want spectators to know the specific unit type that each matryoshka will spawn (because it makes for fun anticipation) but not players, not even the player who owns the matryoshka (because then they have to play around it).
* track some per-team statistic that would involve LoS hax if it could be read by the player (for example 'metal worth killed' where a player could use it to verify the type of things killed in fog of war).
* day-night cycle, but the length of each period has a random component. Or, a gaia boss unit that can be killed and respawns after a random time (think dota roshan). I want spectators to know the exact times but not the players.

### Enemy
* enemy infests a unit (perhaps just for sight, or perhaps he implants something like an alien chest-burster resulting in similar mechanics to the "matryoshka" above). I want that enemy to be able to identify stuff but not the victim.
* a "gather intelligence" ability that lets you read some information about a victim (ally)team, for a limited time. Remaining time is per victim (ally)team and should be accessible only to the (ally)team gathering intelligence, but not the victim.
* respawning boss or day/night cycle with a randomized component, same as above, but an (ally)team can do some action to learn the true time, without revealing it to the other (ally)teams.

These would ideally be done as a unit-, team- and game- rules param respectively, because that is how you attach metadata to things. But there is no param level that is hidden from the "owning" player (and game rules params are public-only currently).

## Request

The request is to add a "secret" rules param level which is only readable to contexts with full read access (spectators and luarules) and a "readable by a specific team" level which can be read by that team.

Loose thoughts:
* ideally the "specific team only" level would be a mask, so you can specify (for example) 2 teams out of 5 or something.
* the "spec only" level is not equivalent to "team only: gaia" because gaia isn't guaranteed to exist; it is equivalent to an empty mask though. But it should probably still be a separate level in the interface for clarity reasons.
* unsure what the Lua API should look like to specify a team or a team mask. Unsure if it should work on the level of teams or allyteams either.

No files or tests are named. Start by tracing existing unit-, team-, and game-rules parameter visibility and the Lua API for specifying levels, then resolve the team-versus-team-mask semantics and full-read contexts described here. Done means the new visibility levels are defined, exposed through the API, enforced for the stated readers, and covered by tests.

Written by the indexing model from the issue text.