Firestore should not access www.google.com, only *.googleapis.com

We are currently rolling out a Content Security Policy. While doing so, we noticed that Firestore sometimes connects to www.google.com, specifically https://www.google.com/images/cleardot.gif. This is because this URL is hardcoded in the webchannel transport:

https://github.com/google/closure-library/blob/7c5e8ef152adf9cc814875c42ab2a0244653b69c/closure/goog/labs/net/webchannel/netutils.js#L48

It would be best if Firestore would only connect to *.googleapis.com domains.

Start with the linked Closure Library file closure/goog/labs/net/webchannel/netutils.js at the referenced line, then trace how Firestore's webchannel transport consumes that URL. Confirm how the transport is brought into the SDK and whether the requested change belongs there; done means Firestore no longer connects to www.google.com and uses only *.googleapis.com domains.

Written by the indexing model from the issue text.