chore: [EXC-1835] Make ic management types private to the execution e…

…nvironment (#3496)

This PR introduces Bazel rules which make the IC management canister
types private to the core crates execution_environment, messaging etc.

All users of the _interface_ are in a temporary whitelist, but are urged
to move to the published version of the types asap. That will be defined
in [cdk-rs](https://github.com/dfinity/cdk-rs) and published to
crates.io.

Context:
https://docs.google.com/document/d/1xvE480Tf61SaJc0AP74_4WDbh01alBU2aQHIRwx3XMw/edit?tab=t.0

---------

Co-authored-by: Michael Weigelt <[email protected]>

rs/types/management_canister_types/BUILD.bazel

@@ -1,7 +1,63 @@
 load("@rules_rust//rust:defs.bzl", "rust_library", "rust_test")
 load("//bazel:fuzz_testing.bzl", "DEFAULT_RUSTC_FLAGS_FOR_FUZZING")
 
-package(default_visibility = ["//visibility:public"])
+# This library is private to the execution environment.
+# These crates are considered direct users of the management
+# types and may always depend on this crate directly.
+permanent_whitelist = [
+    "//rs/execution_environment:__subpackages__",
+    "//rs/cycles_account_manager:__subpackages__",
+    "//rs/messaging:__subpackages__",
+    "//rs/management_canister_types/fuzz:__subpackages__",
+]
+
+# These crates depend on this library directly for historical reasons
+# and must move to the published version of this library on crates.io.
+temporary_whitelist = [
+    "//rs/artifact_pool:__subpackages__",
+    "//rs/bitcoin:__subpackages__",
+    "//rs/canister_client:__subpackages__",
+    "//rs/canister_sandbox:__subpackages__",  # permanent?
+    "//rs/canonical_state:__subpackages__",  # permanent?
+    "//rs/consensus:__subpackages__",
+    "//rs/crypto:__subpackages__",
+    "//rs/determinism_test:__subpackages__",  # permanent?
+    "//rs/drun:__subpackages__",
+    "//rs/ethereum:__subpackages__",
+    "//rs/https_outcalls:__subpackages__",  # permanent?
+    "//rs/ingress_manager:__subpackages__",  # permanent?
+    "//rs/interfaces:__subpackages__",
+    "//rs/ledger_suite:__subpackages__",
+    "//rs/nervous_system:__subpackages__",
+    "//rs/nns/cmc:__subpackages__",
+    "//rs/nns/governance:__subpackages__",
+    "//rs/nns/handlers:__subpackages__",
+    "//rs/nns/integration_tests:__subpackages__",
+    "//rs/nns/sns-wasm:__subpackages__",
+    "//rs/nns/test_utils:__subpackages__",
+    "//rs/orchestrator:__subpackages__",
+    "//rs/pocket_ic_server:__subpackages__",
+    "//rs/prep:__subpackages__",
+    "//rs/recovery:__subpackages__",
+    "//rs/registry:__subpackages__",
+    "//rs/replica:__subpackages__",
+    "//rs/replica_tests:__subpackages__",
+    "//rs/replicated_state:__subpackages__",  # permanent?
+    "//rs/rust_canisters:__subpackages__",
+    "//rs/artifact_pool:__subpackages__",
+    "//rs/sns:__subpackages__",
+    "//rs/starter:__subpackages__",
+    "//rs/state_layout:__subpackages__",  # permanent?
+    "//rs/state_machine_tests:__subpackages__",  # permanent?
+    "//rs/state_manager:__subpackages__",  # permanent?
+    "//rs/system_api:__subpackages__",  # permanent?
+    "//rs/test_utilities:__subpackages__",  # some subpackages permanent?
+    "//rs/tests:__subpackages__",  # some subpackages permanent?
+    "//rs/types:__subpackages__",
+    "//rs/workload_generator:__subpackages__",
+]
+
+package(default_visibility = permanent_whitelist + temporary_whitelist)
 
 rust_library(
     name = "management_canister_types",