Security hardening: reject Firebase credential files inside webroot

Problem/Motivation

Found in codex audit:

- Medium: the credentials path validator does not actually enforce “outside
the webroot.” It only rejects strings starting with public:// at
anata/web/modules/orig/firebase_php/src/Form/FirebasePhpConfigurationForm.p
hp:136. Absolute or relative paths inside DRUPAL_ROOT, including public
files paths, can pass if readable. Canonicalize with realpath() and reject
anything under the webroot/public files directory, including symlink
targets.