Aliases of private services are public

MR reuses the visibility of the aliased service, unsure if this is the correct approach but seems to work.

> \Drupal::service('Drupal\Core\Form\FormCacheInterface');

   Symfony\Component\DependencyInjection\Exception\ServiceNotFoundException  You have requested a non-existent service "Drupal\Core\Form\FormCacheInterface".

> unserialize(Drupal::service("kernel")->getCachedContainerDefinition()['services']['form_builder']);
= [
    "class" => "Drupal\Core\Form\FormBuilder",
    "arguments" => {#7337
      +"type": "collection",
      +"value": [
        {#7341
          +"type": "service",
          +"id": "form_validator",
          +"invalidBehavior": 1,
        },
        {#7339
          +"type": "service",
          +"id": "form_submitter",
          +"invalidBehavior": 1,
        },
        {#7338
          +"type": "private_service",
          +"id": "private__G8Uu4hTcUgjMeXKACab9jV6Lz0_L84M9F590Ayb57E0",
          +"value": [
            "class" => "Drupal\Core\Form\FormCache",
            "public" => false,
            "arguments" => {#7336
...

Some test failures to sort out.

Fixed some tests. backend_overridable backend services must follow the visibility of the service being overridden. JSON:API had a public alias to a private service in a test, which I think was relying on this bug; worked around this by adding another compiler pass to the test to make the service public again.

Alternatively maybe we should just explicitly copy the visibility of the original alias in autowired service aliases? AutowireTest could be extended to check for this.

One very small nit on the MR, but overall the approach seems good to me, as you say a good first step to private-by-default services.

@longwave don't mind marking if you can take a look at the one thread.

Had some time so went ahead and applied the change mentioned in the MR.

It feels like we're missing test coverage of the heart of this change - the bit where we copy the visibility from the service definition to the alias.

Added test coverage.

Done, let's see what the tests say. Also reapplied @catch's nit which I inadvertently removed when rebasing earlier.

Well, that breaks the tests that use backend overridden services..