Use an object to for privacy level models

This makes the association between the level key name and the display
text explicit and tight in the code.
Merge pull request #1741 from hypothesis/sticky-visibility-level-object

Use an object for privacy level models