reflection: add a proto option to let servers exclude selected services/methods/fields

**Problem**

Reflection is all-or-nothing: once `reflection.Register` runs, every descriptor is exposed. Projects often need to show only stable RPCs while iterating on new ones.

---

**Proposal**

Add a `visibility` option (similar to `google.api.visibility`) that reflection implementations must respect.

```proto
message VisibilityOptions {
enum Level {
PUBLIC = 0; // default – expose
INTERNAL = 1; // hide from reflection
}
Level level = 1;
}
```

Anything tagged `INTERNAL` is omitted from reflection responses.

Any thoughts?