flagged as insecure / outdated root detection (OWASP MASTG-KNOW-0027) and unreliable on modern Android devices (refs #5525, #2495)

### [READ] Step 1: Are you in the right place?

Issues filed here should be about bugs in **the code in this repository**. If you have a general
question, need help debugging, or fall into some other category use one of these other channels:

- For general technical questions, post a question on [StackOverflow](http://stackoverflow.com/)
with the firebase tag.
- For general Firebase discussion, use the
[firebase-talk](https://groups.google.com/forum/#!forum/firebase-talk) google group.
- For help troubleshooting your application that does not fall under one of the above categories,
reach out to the personalized [Firebase support channel](https://firebase.google.com/support/).

### [REQUIRED] Step 2: Describe your environment

- Android Studio version: **Otter 2025.2.3**
- Firebase Component: **Crashlytics** (Database, Firestore, Storage, Functions, etc)
- Component version: **19.4.0 -> latest**

### [REQUIRED] Step 3: Describe the problem

The method CommonUtils.isRooted() is currently being flagged by third-party independent security researchers during mobile application assessments based on OWASP Mobile Application Security Testing Guide (MASTG), specifically[ MASTG-KNOW-0027: Root Detection.](https://mas.owasp.org/MASTG/knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0027/)

While OWASP clearly states that root detection is not a vulnerability by itself, the current implementation in Firebase appears to:

Rely on outdated / simplistic heuristics (e.g., static file checks, basic binaries presence).
Produce unreliable results on modern Android versions, including false positives and false negatives.
Not align with modern root detection practices (multi-layered, runtime-aware, obfuscation-resistant approaches).
Be easily bypassable, which reduces its value even as a soft anti-tampering signal.

Additionally, this method has already shown instability and incorrect behavior on newer Android devices, as discussed in:

Issue #5525 (detection on Android 13+)
Issue #2495 (detection on emulators)

These reports suggest that isRooted() may no longer behave consistently across API levels and device configurations (e.g., scoped storage, system-as-root, modern SELinux policies, Magisk hiding, etc.).

#### Steps to reproduce:

Use Firebase Crashlytics in an Android app.
Run the app on:
- Android devices across modern API levels (Android 10 / 12 and 13+)
- Either rooted (with Magisk hiding) or non-rooted device
Observe:
- Inconsistent isRooted() results depending on environment
- Security scanners flagging the implementation as insufficient / non-compliant with OWASP recommendations

Security review tools specifically flag:

- Static file path checks (/system/xbin/su, etc.)
- Lack of runtime or behavioral checks
- No mitigation for modern root-hiding techniques

#### Expected behavior:
CommonUtils.isRooted() should either:
- Use a modern, more reliable root detection approach compatible with current Android versions, or
- Be clearly documented (or deprecated/removed) as non-security-grade, so it is not flagged during security reviews.
Given that Firebase Crashlytics is widely embedded across production applications, its internal utilities should not introduce audit friction or trigger OWASP-related findings in downstream apps.

#### Relevant Code:

https://github.com/firebase/firebase-android-sdk/blob/main/firebase-crashlytics/src/main/java/com/google/firebase/crashlytics/internal/common/CommonUtils.java#L321