Profile data are retrieved from ID token without verifying the token

**Describe the bug**
Bug location: https://github.com/google/GoogleSignIn-iOS/blob/7932d33686c1dc4d7df7a919aae47361d1cdfda4/GoogleSignIn/Sources/GIDSignIn.m#L803
Here, profile data (email, name, profile picture, etc.) are being retrieved from the ID Token without verifying the integrity of the token. Ideally, an ID Token would be sent over to the backend server, which first [verifies the signature of the token](https://developers.google.com/identity/sign-in/ios/backend-auth) before using the profile information from the payload.

But, in this case, since we are directly retrieving the sensitive profile information (from ID Token's payload) to sign in a user, should we not verify the token first? Especially for mobile or desktop apps (which is the case here) where intermediary-free TLS cannot always be guaranteed?

Additionally, we are not using any CSRF protection (e.g, [PKCE](https://www.rfc-editor.org/rfc/rfc7636)), so I think it is critical to verify the integrity of the ID Token before accepting the profile information from it.