refactor(auth): narrow the credential-manager test seams to internal

[demolaf]

Narrows the com.firebase.ui.auth.credentialmanager package and the FirebaseAuthUI test seams while that is still free to do. After the GA cut it would no longer be. :e2eTest drives several of these seams, so it gets friend-path access to :auth in the same change.

Changes

• internal plus @RestrictTo(LIBRARY_GROUP) on all seven declarations in credentialmanager/: PasswordCredential, CredentialManagerProvider, DefaultCredentialManagerProvider, PasswordCredentialHandler and its companion seam, PasswordCredentialException and its two subclasses.
• internal on FirebaseAuthUI.testCredentialManagerProvider, testLoginManagerProvider and clearInstanceCache(), each keeping its @RestrictTo, matching what getCacheSize() already did.
• Delete the "Set this in your test setup" worked example from PasswordCredentialHandler's companion KDoc, which is what invited consumers to depend on the seam, and an orphaned KDoc line on FirebaseAuthUI that documented a property that no longer exists.
• Add a friendPaths block to e2eTest/build.gradle.kts, scoped to the unit-test compilations, filtering the compile classpath (libraries) for entries under auth/build rather than hardcoding the AGP intermediates jar it resolves to today.

Why @RestrictTo stays rather than being replaced by internal

internal is Kotlin-only. A top-level internal class emits ACC_PUBLIC, and a public member of an internal class's companion is not name-mangled, so PasswordCredentialHandler.Companion.setTestCredentialManagerProvider(...) stays callable from Java either way. @RestrictTo is what drives the RestrictedApi lint check, and it is the only signal a Java consumer gets. Verified against the compiled classes.jar rather than assumed.

Why this needs no deprecation cycle

PasswordCredentialHandler.testCredentialManagerProvider carried no @RestrictTo and its KDoc told consumers how to set it, but it is a test seam, never intended as public API. Nothing here was API to break.

Friend-path notes

Appending -Xfriend-paths to compilerOptions.freeCompilerArgs is ignored, because KGP generates that flag itself from the typed friendPaths property, and pointing at auth/build/tmp/kotlin-classes/debug fails because :e2eTest never sees that directory. Both were measured. The wiring hangs off org.jetbrains.kotlin.gradle.tasks.KotlinCompile, so the pending AGP 9.0 built-in-Kotlin migration will need it rewritten.

Out of scope

FirebaseAuthActivity, FirebaseUIComposeRegistrar and FirebaseAuthUI.updateAuthState stay exactly as they are, neither documented nor narrowed.

---

Maintainer note: Fixes internal CPRN-492
Maintainer note: Fixes internal CPRN-493

[gemini-code-assist]

Code Review

This pull request restricts the visibility of several classes, interfaces, and properties in the auth module to internal to better encapsulate them within the library. The feedback suggests adding the @Volatile annotation to the mutable test provider properties in FirebaseAuthUI to guarantee thread visibility during asynchronous operations. Additionally, it is recommended to change the base class PasswordCredentialException to internal to maintain consistency with its subclasses.