FR: roles from microsoft ID token

### Describe your environment

* Operating System version: macOS 10.14.6 (Mojave)
* Browser version: Chrome 76 (and others)
* Firebase SDK version: 6.4.1
* Firebase Product: auth

### Describe the problem

*TLDR: Can we get the ID-Token (or the claims it contains) from the Microsoft Azure AD authentication provider in the client side `AuthCredential`*

We are setting up Firebase Auth using Microsoft Azure Active Directory as described at https://firebase.google.com/docs/auth/web/microsoft-oauth
This works great, but we also use the feature in Azure AD to define application-roles. These can be mapped to individual users or groups within the active directory. Details on how to configure this are at https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps

The roles that are assigned to the user are put into the ID-Token by Azure Active Directory. If we login directly (not using Firebase) we can see this in the token:
```json
{
"aud": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"iss": "https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/",
...
"name": "Test User",
"roles": [
"normal-user"
],
"unique_name": "user@xxxxx.team",
"upn": "user@xxxxx.team",
}
```

However, if we use Firebase Auth to connect to Microsoft, we obviously get a token from firebase (not microsoft). The closest we can get is using `firebase.auth.Auth.getRedirectResult` to get the `UserCredential `. This contains a key `credential` which contains a`AuthCredential`. According to the documentation, this should contain the credentials returned by an auth provider.
However this only contains a few keys: `providerId`, `signInMethod`, `oauthAccessToken` and `pendingToken`. As the name implies, the oauthAccessToken is the access token supplied by microsoft and not the ID-token.

Would it be possible to also include the id-token from the auth provider in the `AuthCredential`? This can contain valuable information for the user-interface (such as the roles). If you do not want to include the entire token, perhaps it would be possible to only include the claims or the roles?

Most enterprises already manage their users and roles in Azure AD and having access to the application roles through firebase would make Firebase+AzureAD a real killer for enterprise apps.

Review the Auth.getRedirectResult flow and the UserCredential/AuthCredential structures, focusing on Microsoft provider handling and the existing oauthAccessToken and pendingToken fields. Determine how the provider ID-token claims or roles should be exposed, with completion meaning the requested Microsoft roles or claims are available to the client.

Written by the indexing model from the issue text.