Prevent @Bean method being public if it should not be

[quaff]

Fix the violation that classes are exposed outside their defined visibility scope.

[wilkinsona]

This is close to being part of #32883 although we want to go further and make all @Bean methods package-private. We're holding off on doing that at least until the restructuring work is complete to avoid lots of conflicts on merge or rebase. Unfortunately, I don't think we can use this PR as it'll either create lots of conflicts if we merge it now, or have to be almost completely redone once the restructuring has landed. Thanks anyway.