properly determine visibility of non-package-type projects

[travi]

packages are able to derive this information from publishConfig.access in the package.json.

• is .github/settings.yml the best source of this info for apps?
• if we get it there for apps, should we just be consistent and use the same source for packages?
• which visibility are we truly interested in? repo visibility or visibility of a published package?