Taking Standards Seriously: The Case for a Private Standards-Based Approach to AI Governance