Which Solidity visibility modifier should be used for a function that must only be callable from within the same contract or derived contracts?