Support an "explicit_artifacts" and "transitive_artifacts" separation with separate visibility

[cgruber]

Allow the provision of transitively-accessed deps - needed to satisfy the graph, but not directly referenced in the project. This can be directly configured or maybe a pin-file. This file could be generated. The artifacts referenced there must not be in the direct list, and they are visibility locked to the external workspace they're defined in. This can allow the artifact list to be more manageable, and a more precise targeting and management.