Move permission-checking code into a separate type

This code is likely to be common to any `Auth` implementation which wants to perform actual permission checks. It therefore doesn't really belong in Firebase-specific code:

https://github.com/google/peoplemath/blob/2fcd365d754f59a819a6e8a917c85fa63da81ff2/backend/auth/firebase.go#L68