resourceloader: Add missing @private and @protected to mw.loader methods

Several local functions were indexed by JSDuck as mw.loader methods whereas
they are in fact they don't even exist on that object. Mark them as @private.

Also add @protected on the internal methods 'work()' and 'require()',
which are public but not for general use (and may change without warning).

Change-Id: If521cc5ae4a565a46161890cf32e95a8c7f4ca50