Firebase functions insecure custom claims management

Flags scenarios where custom claims are set using admin.auth().setCustomUserClaims() by functions that may not be authorized to grant such claims or where the input determining the claims is not validated. Insecure custom claim management can lead to privilege escalation.