Add more stringent Cloud Storage rules

[samtstern]

Right now we have:

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

We should look into ways to make access controls more effective.

[samtstern]

cc @rachelsaunders