Add more stringent Cloud Storage rules

Right now we have:

```
rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}
```

We should look into ways to make access controls more effective.