We can change KPI across major versions at least, can't we?

This change has several goals. The first is to prevent consumers from using any of these individual functions, which are called by cr_bsd_visibility() itself. This helps avoid bugs where some callers forget to check if a particular policy authorizes accesses, which is exactly what happened with see_jail_proc. A second goal is that, more conceptually, visibility policies can be seen as a block that should be applied at once. If, in the future, some policy is added, it will just have to in cr_bsd_visibility() (no need of sprinkling calls all around).