`@private` not enforced in some cases

[milesziemer]

This issue arose from investigation into #1369.

This example shows cases where @private is not enforced:

$version: "2"

namespace example.private

@private
resource PrivateResource {
    identifiers: {
        id: String
    }
}

@mixin
structure MixinWithPrivateMember {
    @private
    member: String
}

$version: "2"

namespace example.public

use example.private#PrivateResource
use example.private#MixinWithPrivateMember

// 1. Target elision with private resource
structure PrivateResourceUsage for PrivateResource {
    $id
}

// 2. Target elision of private member of mixin
structure PrivateMemberOfMixinUsage with [MixinWithPrivateMember] {
    @required
    $member
}

From what I can tell, the resource-structure binding syntax (for) is not modeled by the JSON AST, which is what the validation tests use, so there may not be an obvious way to enforce @private for 1. For 2., it's not clear to me whether this case should be allowed or not. The private member member is being referenced in a different namespace, but maybe this is expected behavior for mixins.