[FEAT]: create server only access control for loaders and actions

[IncognitaDev]

This PR adds the capability of export a access control const defaultVisibility that determines if a loader or a action is server only acessible or public accssible.

A server only accessible loader/action its only callable by ctx.invoke, this prevent exposing private endpoints on webisite calls on client.

Exemple:

export const defaultVisibility = 'private'

export const defaultVisibility = 'public'

[github-actions]

Tagging Options

Should a new tag be published when this PR is merged?

• 👍 for Patch 1.108.4 update
• 🎉 for Minor 1.109.0 update
• 🚀 for Major 2.0.0 update

[IncognitaDev]

I add a visibilityOverride to deco plugin that allows overrite the visibility of a block. With this you can explicity turn a default private block to act as public or a public to act as a private one.

usage:

import { defineConfig } from "$fresh/server.ts";
import { plugins } from "deco/plugins/deco.ts";
import manifest from "./manifest.gen.ts";

export default defineConfig({
  plugins: plugins<typeof manifest>({
    manifest,
    htmx: true,
    visibilityOverrides:  {
      "site/loaders/minicart.ts": "public",
    },
  }),
});