Add "visible_to_staff_only" field to support staff locking in Studio.

STUD-1875

@andy-armstrong and @benmcmorran Please review.

@cpennington I have added to _has_access_descriptor in LMS' access.py. Can you either review or defer to someone else appropriate from the LMS team?
This should probably also be in the CMS XBlock mixin. In general, the `InheritanceMixin` should only include copies of fields defined elsewhere. (And eventually, should just include either references to those fields, rather than copies, or the fields should just be annotated as inheritable).