The class Less determines the allowed flows of information. Less l l'
tests the order relationship of l and l' in the lattice, i.e., if l
⊑ l'.
The sole purpose of the unexported class CanFlowTo is to restrict
untrusted code from making arbitrary instances of the class Less (credit to
Pablo Buiras!)