Allow //visibility:public and //visibility:private in non-singleton visibility declarations

... but simplify the resulting visibility appropriately when saving the
visibility attribute: $foo plus public is public; $foo plus private is $foo;
and an empty visibility list is canonicalized to ["//visibility:private"].

This makes it easier for symbolic macros to grant visibilities on targets
that they declare.

Work toward https://github.com/bazelbuild/bazel/issues/19922.

The canonicalization of an empty visibility list to ["//visibility:private"]
is technically an incompatible change affecting query output, but is very
unlikely to break anything in practice.

RELNOTES: Non-singleton target visibility lists can now contain "//visibility:public" and "//visibility:private" elements; the result is appropriately simplified when assigned to an attribute: ["//foo:__subpackages__", "//visibility:public"] is saved as ["//visibility:public"], ["//foo:__subpackages__", "//visibility:private"] is saved as ["//foo:__subpackages__"], and for consistency's sake, an empty target visibility list [] is saved as ["//visibility:private"].
PiperOrigin-RevId: 680761159
Change-Id: Ic2edaf13dfe48b0f0014d404ced34aa7632d33c7