Support configuring default collection visibility

This adds a new default_visibility config value that lets an instance
admin set the visibility of newly created collections.

Ref T675