Separate NextAction visibility from contexts

This paves the way for other usages which care about visibility, but don't care
about contexts.  (For example, gathering the contexts of all visible
NextActions.)
Add TrustedSystem.ContextList()