[FR]: Ability to proxy identitytoolkit and securetoken hosts

### Description

1. Since the auth tokens are public, this allows attackers to brute force with credential stuffing attacks, by hitting the firebase auth api directly. Firebase should allow overrides for organizations to allow proxying the auth endpoints so that they can be placed behind firewalls and have more control to combat attacks.
2. Currently organizations are at the mercy of attackers since Firebase host scripts only trigger on a successful login attempt.
3. Allowing organizations to override the auth endpoint so that it is proxied through a service behind a firewall, this gives organizations to block the public api key from hitting firebase auth / identitytoolkit endpoints directly. When proxied, the real auth key can be appended to the end of the requests and placed behind a firewall for additional security checks to prevent credential stuffing.

### API Proposal

No API changes are required

### Firebase Product(s)

Authentication

The issue does not name any files, tests, or entry points. Start by locating the Firebase Authentication host configuration and reviewing how identitytoolkit and securetoken endpoints are selected. Done would require an agreed design and support for routing those endpoints through an organization-controlled proxy without an API change.

Written by the indexing model from the issue text.