Come up with a design for simple FTL visibility system

[alecthomas]

Currently every verb has visibility of all others in the entire cluster, and the only visibility controls are whether a function is marked as ingress or not.

Some ideas to kick things off:

• Model it on programming languages? Public, protected, private, and package scoped vs. module scoped.
• Introduce the concept of groups of modules with a visibility boundary?

Doc here

Issues:

• Rename ftl:export to ftl:verb and ftl:data #1324
• Update ftl.call/controller to enforce visibility rules #1354
• Update external module code generator to not generate decls based on visibility #1376

[wesbillman]

Checklist complete :)