End all private headers by -private.h

This also adds an API visibility linter script to check that we don't accidentally export headers tagged as private.

Fixes https://gitlab.gnome.org/aplazas/libmanette/issues/16.

CC @exalm