[modules] This check is run before we resolve the header, not after, so just

check that private headers are in a list matching the role. (We can't perform
the opposite checks for non-private headers because we infer those.)

llvm-svn: 231728