[GoogleAppMeasurement 12.17.0] IDFV persisted in plaintext in google-app-measurement.sql — flagged as "PII in Internal Storage" by security scanner (NowSecure)

### Description

# Title
[GoogleAppMeasurement 12.17.0] IDFV persisted in plaintext in google-app-measurement.sql — flagged as "PII in Internal Storage" by security scanner (NowSecure)

# Description

## Environment
- firebase-ios-sdk 12.17.0, GoogleAppMeasurement 12.17.0 (SPM)
- Products: FirebaseAnalyticsCore (IDFA/Ad-ID disabled) + FirebaseCrashlytics
- Device/OS: iPad7,5 / iOS 17.7.10

## Summary
A NowSecure security scan flagged "PII in Internal Storage." The evidence is the device IDFV stored in plaintext inside Firebase Analytics' internal Measurement SQLite database. This file is created and written by GoogleAppMeasurement (Firebase Analytics), not by our application code — our source does not read or write this file.

## Evidence
- Sensitive data type: Identifier for Vendor (IDFV)
- Encoding: plaintext
- File: Library/Application Support/Google/Measurement/google-app-measurement.sql
- Scope: File System

## Code path
GoogleAppMeasurement.xcframework (closed-source binary) creates and writes
Library/Application Support/Google/Measurement/google-app-measurement.sql, storing the
IDFV to attribute analytics events. Our application code does not access this file.

## Questions / requests
1. Please confirm the purpose of persisting the IDFV in google-app-measurement.sql and that it is required for Analytics event attribution.
2. Please confirm the storage protection applied to this file (e.g., sandboxed, backup-excluded, iOS Data Protection class), and whether the IDFV is stored in plaintext by design.
3. Are there plans or supported options to encrypt, hash, or otherwise avoid persisting the IDFV in plaintext at rest?
4. Is there a supported configuration to reduce or avoid this on-disk PII storage without disabling Firebase Analytics?
5. Any official guidance/attestation we can provide to security auditors regarding this finding.

### Reproducing the issue

_No response_

### Firebase SDK Version

12.17.0

### Xcode Version

26.6

### Installation Method

Swift Package Manager

### Firebase Product(s)

Analytics, Crashlytics

### Targeted Platforms

iOS

### Relevant Log Output

```shell

```

### If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

```json

Replace this line with the contents of your Package.resolved.

```

### If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

```yml

Replace this line with the contents of your Podfile.lock!

```

Start by reviewing the reported Library/Application Support/Google/Measurement/google-app-measurement.sql path and the GoogleAppMeasurement.xcframework code path described in the issue; no repository source file or test is provided. Done means documenting whether IDFV persistence is required, what storage protection applies, and whether supported mitigation or configuration exists.

Written by the indexing model from the issue text.