CPS should have component visibility

For various technical reasons, some packages are very likely to consist of several libraries of which some are not intended to be directly consumed by external users. Because CPS strongly recommends that each library has a corresponding component, this means that "properly written" CPS files may need to reference components that should not be externally referenced.

This is a classic incarnation of the common "visibility problem". While recognizing that circumvention will be possible — and, also, that this is not a critical issue — it would be clearly beneficial to have a way to mark a component as "local" to a package.

We should add such an attribute. A component so-marked may be required by another component of the same package, but directly referencing it from another package / the consuming build should be strongly discouraged. (Read: tools shall be permitted to treat this as an error.)

See #29.