ci: Check the API visibility

Check we don't accidentally add private headers to public ones, and that
all public headers are included in the public handy.h. We do so by
running the newly added lint/api-visibility.sh script during the build
stage. This script can be run locally too.
8 jobs for api-visibility in 13 minutes and 28 seconds (queued for 2 seconds)