Support package visibility for @BrowserCallable services

[peholmst]

Describe your motivation

The visibility of an annotated class should not affect whether the annotation is applied or ignored. Furthermore, Spring REST controllers can be package-private. Since @BrowserCallable services is our alternative to them, they should behave in a similar manner.

Describe the solution you'd like

Make it possible to use @BrowserCallable on package-private services. When put on a class, this would expose all public methods of the class.

Consider making it possible to add the annotation to individual methods as well. This would make it possible to expose methods with other visibilities. If the method is annotated, it can be called from the browser, regardless of whether it is public, package-private, protected, or even private.

For the DTO:s, consider relying on Jackson annotations. What ends up in the JSON would end up in the generated TypeScript data type.

Describe alternatives you've considered

No response

Additional context

Please see this forum discussion: https://vaadin.com/forum/t/thoughts-on-non-public-browsercallable-services/167535

[Legioth]

I would see it as as separate feature to annotate individual methods. That's useful when you have a service that is used by different parts of the application (e.g. also a Flow UI) and only want to make some specific parts of it available to the Hilla client. Currently, you have to create a separate class for to make that possible.

[cromoteca]

For the DTO:s, consider relying on Jackson annotations. What ends up in the JSON would end up in the generated TypeScript data type.

Isn't that already the case? We ask Jackson which properties a class has.

[Legioth]

I guess the point is that we shouldn't try to change Jackson to also consider package-private members by default but instead just stick to the existing defaults there.

[cromoteca]

This is also related to #2616, since loading services from Spring would automatically delegate to Spring which services are available.

[platosha]

Would make sense to do this together with or after #2616.