Check we don't accidentally add private headers to public ones, and that
all public headers are included in the public handy.h. We do so by
running the newly added lint/api-visibility.sh script during the build
stage. This script can be run locally too.