[tests] restrict visibility of our internal test-only copy of the xDS protos

We really should not have our own copy of these protos in the first
place, but there's some tech debt here that hasn't been cleaned up yet.
Until we do that, we should at least ensure that this tech debt doesn't
spread by having more code depend on them.

PiperOrigin-RevId: 683631165

bazel/grpc_build_system.bzl

@@ -725,7 +725,7 @@ def grpc_package(name, visibility = "private", features = []):
         features: The features to enable.
     """
     if visibility == "tests":
-        visibility = ["//test:__subpackages__"]
+        visibility = ["//test:__subpackages__", "//src/proto/grpc/testing:__subpackages__"]
     elif visibility == "public":
         visibility = ["//visibility:public"]
     elif visibility == "private":

src/proto/grpc/testing/xds/v3/BUILD

@@ -23,7 +23,7 @@ exports_files([
 
 grpc_package(
     name = "xds_v3",
-    visibility = "public",
+    visibility = "tests",
 )
 
 grpc_proto_library(
@@ -331,6 +331,8 @@ grpc_proto_library(
     srcs = [
         "csds.proto",
     ],
+    # Needs to be visible to //:grpcpp_csds
+    visibility = ["//:__subpackages__"],
     well_known_protos = True,
     deps = [
         "base_proto",