Move forbidden_visibility_error from base to inheriting clas

The following discussion from !188313 (merged) should be addressed:

• @hustewart started a discussion: (+1 comment)

  I'm pretty sure that CreateService is the only one that uses this method forbidden_visibility_error. Probably worth moving this into CreateService and out of the base class, as eventually I'd like to completely remove the base class as it does things like mutating params.