Restrict visibility to Envoy internals in consuming projects

Today, the Bazel visibility for all targets (from source, to test support to the tests themselves) is public. This means that a project that consumes Envoy and adds its own filters etc., might rely on internal implementation details that are not intended to be stable aspects of the API.

We should restrict visibility outside of Envoy to only its interfaces, well defined library/binary exports (`//source/exe:envoy`, `//source/exe:envoy_main_lib`) and common code under `::Api::` that should be explicitly shared and is subject to the same API considerations as the Envoy interfaces in `include`.