Limit visibility of plugin's start/stop to plugin package

As any code can obtain Plugin instances by name through the
PluginLoader, any code could invoke the public start/stop methods on
Plugin instances. However, we better leave starting, and stopping of
plugins to the PluginLoader. To better enforce this, we limit the
visibility of those methods to the plugin package.

Change-Id: Ifd886c7e95b3fbb370ad4a4b69d07b0dd8883b8c

gerrit-server/src/main/java/com/google/gerrit/server/plugins/Plugin.java

@@ -172,7 +172,7 @@ public class Plugin {
     return disabled;
   }
 
-  public void start(PluginGuiceEnvironment env) throws Exception {
+  void start(PluginGuiceEnvironment env) throws Exception {
     Injector root = newRootInjector(env);
     manager = new LifecycleManager();
 
@@ -264,7 +264,7 @@ public class Plugin {
     return Guice.createInjector(modules);
   }
 
-  public void stop() {
+  void stop() {
     if (manager != null) {
       manager.stop();
       manager = null;