Use hidden visibility when compiling externals

[jwnimmer-tri]

When building private externals from source (i.e., anything other than #7451), we should use hidden symbol visibility, so that downstream users of Drake can use their own, different version of that code without any link-time or load-time conflicts.

For C code, we can use -fvisibility=hidden. For C++ code, can use //tools/workspace:vendor_cxx if it compiles.

Checklist:

• [workspace] Add abseil-cpp dependency #16774
• [workspace] Better hide ccd and fcl externals #18678 (ccd)
• [workspace] Build vendored clp_internal from source #19928
• [workspace] Upgrade common_robotics_utilities to latest commit #19893
• conex
  • [workspace] Deprecate the conex external #19883
  • [workspace] Switch conex to use hidden namespace #19892
• [workspace] Deprecate the csdp external #19894
• [workspace] Add private curl build from source #17755
• [workspace] Better hide ccd and fcl externals #18678 (fcl)
• [common] Switch to std::filesystem #17834
• [workspace] Remove the libcmaes external #20245
• [workspace] Build msgpack privately from source #18559
• Ipopt
  • Mumps in Homebrew #20429
• Mumps
• [workspace] Build NLopt from source #17288
• [workspace] Deprecate public use of several externals #18690 (osqp)
• [workspace] Deprecate the petsc external #19890
  • Remove dependency on PETSc #19882
• [workspace] Deprecate the picosha2 external #19879
• [workspace] Deprecate public use of several externals #18690 (qdldl)
• [workspace] Improve qhull hidden visibility #17229
• [workspace] Deprecate public use of several externals #18690 (scs)
• [workspace] Use sdformat hidden visibility #17230
  • ignition_math
  • ignition_utils
• [workspace] Deprecate the stduuid external #18610
• [workspace] Deprecate the tinyobjloader external #19880
• [workspace] Build tinyxml2 from source #17830
• [workspace] Deprecate public use of several externals #18690 (suitesparse)
• [workspace] Deprecate the usockets and uwebsockets externals #19889 (usockets)
• uwebsockets
  • [workspace] Deprecate the usockets and uwebsockets externals #19889
  • Switch to hidden namespace
• [workspace] Bump VGT to support hidden visibility #20387
• Link VTK privately #16502
• [workspace] Build yaml-cpp from source #16756
• [workspace] Build libpng_internal from source #20276
• [workspace] Build libtiff_internal from source #20331
• [workspace] Build libjpeg_turbo_internal from source #20343

Tricky, possibly unsolveable:

• lcm

The overall plan for all externals lives in this spreadsheet.

Closing the loop:

• [tools] Add test to flag hazardous exported symbols #20279
• Ongoing for the list of "known bad symbols" in that new linter.
  • ...

Additional tasks:

• Documentation in tools/workspace about the current policy, how to add a new external, etc.
• Check if vendor_cxx.bzl can offer any more sugar macro(s) to reduce boilerplate.

[jwnimmer-tri]

We are getting really close here!