Documentation Issue: Authentication - Short Lived Access tokens will in fact work

### [REQUIRED] Environment info

Documentation. https://github.com/firebase/firebase-tools#authentication

**firebase-tools:**

n/a

**Platform:**

n/a

### [REQUIRED] Test case

n/a - documentation issue

### [REQUIRED] Steps to reproduce

n/a - documentation issue

### [REQUIRED] Expected behavior

The current authentication documentation states: "User Token - provide an explicit long-lived Firebase user token generated from firebase login:ci. Note that these tokens are extremely sensitive long-lived credentials and are not the right option for most cases."

This makes a user believe that only a long lived refresh token can be passed as a user token.

### [REQUIRED] Actual behavior

In reality, a short lived access token with the correct scopes will work correctly. Under the covers, the code will attempt to use the passed token as a refresh token, but if that fails with a 401 or 400 error, it will use it as an access token instead.
See ```src/auth.ts``` and the line: ```return { access_token: refreshToken };```

This is a great feature as it allows a CI pipeline or similar to be vended with a short lived access token (e.g. using a workload identity style service) and can eliminate refresh tokens being used as much. We have leveraged this in our CI/CD pipeline, with a Gitlab CI job JWT being exchanged for a short lived access token, and it works well.

It would be great to update the documentation to make people aware that access tokens will in fact work as a user token.