Firebase-admin verifies expired token (Cause of expiration: Change in credentials)

### Environment

I'm using ubuntu 21
Firebase-admin 10.2.0
node v16

#### Steps to reproduce:

1. In the web app, sign in with your firebase user credentials (email/password in my case)
2. Now make a request to your backend API accessing an endpoint that will modify the user's email.
3. After this, the front-end app will indicate that the user needs to reauthenticate with firebase when trying to use the old token to make firebase requests.
4. Yet on the backend application, the front end can still send the old token to my backend API and the `verifyIdToken` method still validates the token and proceeds.

Start at the verifyIdToken entry point and reproduce the reported sequence using the stated Ubuntu, Node v16, and Firebase Admin 10.2.0 environment. Confirm the expected token-expiration behavior after the user's email changes, then trace the relevant authentication tests or add a regression test; done means the old token is handled consistently with that expectation.

Written by the indexing model from the issue text.