Check for over-exposed APIs

We noticed in https://github.com/line/armeria/pull/2343 that there is a public interface for controlling timeout marked as internal-only in Javadoc. Generally, we should be able to avoid that by using the internal package, but we may have some APIs that are exposed that shouldn’t be.

A couple I found are

• DefaultServiceRequestContext
• DefaultClientRequestContext

I think users are supposed to use request context through their interfaces so do these need to be public classes? If we need to allow users to instantiate these objects, it follow our pattern better to have factory methods on e.g. ServiceRequestContext that returns ServiceRequestContext by creating DefaultServiceRequestContext instead of directly exposing the class I think. This would also allow hiding classes like TimeoutController

[trustin]

Yeah, that’s what I’m referring to. 😄

[trustin]

For the classes that cannot be hidden, we could introduce annotations like @UnstableApi (similar to Guava’s @Beta).