Forwarding can create visible private exports from a module #4065

The following currently compiles without error:

// _upstream.scss
$value: "hello!";

// _midstream.scss
@forward "upstream" as --*;

// downstream.scss
@use "midstream" as *;

@debug $--value;

This is correct per spec, but not desirable from a design perspective. There should be no way to access private member names through the module system, even if they weren't originally declared as private. (Note that accessing $--value through a module namespace currently fails in Dart Sass. As I read the spec this "should" be allowed, but I think prohibiting it is desirable.)

Ideally, we would just prohibit a @forward prefix beginning with - or _. However, they may be useful for migration purposes—@import had no notion of privacy, and some users wrote libraries whose prefixes began with -- in practice, so it's desirable to preserve those in import-only files for backwards-compatibility. As such, I think the plan here should be four-stage:

1. Deprecate accessing members beginning with - through @use, @forward, or sass:meta functions (meta.module-* should probably just produce a deprecation when used on a module that contains any of these, since we can't easily check when these specific variables are accessed.)

2. Remove these from the module entirely as special case of the semantics of @use and @forward. This ensures they'll never be visible through the module system, without making them inaccessible to @import.

3. Once we're getting close to removing @import for good, deprecate @forward prefixes that begin with -.

4. Finally, at the same time as the final @import removal, forbid @forward prefixes that begin with - and remove the special-casing from @use and @forward.