add private media library for integrations

[erquhart]

For users of custom asset store integrations, "private" assets requiring authentication for read access can be uploaded through the CMS. This PR adds media library support for private asset handling:

• Switches to a "private" mode when launched from an image or file widget configured as private
• Resets media library state to default when switching in and out of private mode
• Ignores async media library state changes from that did not originate from the current mode
• Visually distinct so the user knows they're viewing private assets

There is a possibility that a user could experience non-destructive bugs by initiating a long async request, like an upload, and then switching modes twice to arrive back in the same mode before the request finishes. Documented in #835.