Internal state errors accessing prototype methods using DocumentSnapshot.get()

### [REQUIRED] Describe your environment

* Operating System version: Windows 11
* Browser version: Google Chrome 104.0.5112.10
* Firebase SDK version: 9.9.3
* Firebase Product: firestore

### [REQUIRED] Describe the problem

#### Steps to reproduce:
Passing a field to `DocumentSnapshot.get()` that does not exists on the document itself, but matches a property of `Object.prototype` throws Internal State errors (eg: toString). This happens because `DocumentSnapshot.get()` looks at `mapvalue.fields` as shown below, which will also match and return prototype methods.

```js
return e = (e.mapValue.fields || {})[t.lastSegment()], e || null;
```

My suggestion would be to exclude prototype methods, by first checking if the key exists using `Reflect.ownKeys(e.mapValue.fields || {})`, `e.mapValue.fields.hasOwnProperty()`, or something similar.

#### Relevant Code:

```javascript
import { doc, getDoc } from "firebase/firestore";

const docRef = doc(db, "cities", "SF");
const docSnap = await getDoc(docRef);

// Will throw an Internal State error if toString does not exist on the document
// Uncaught Error: FIRESTORE (9.9.3) INTERNAL ASSERTION FAILED: Unexpected state
docSnap.get('toString');
```