Pending breaking changes #323

These changes would alter behaviour or public types for existing code, so it would help to ship them together with a clear release note.

1. set_global_options() defaults cpu to "gcf_gen1". Per-function options and Node's setGlobalOptions leave it unset. Setting only a region is enough to change every function:

   @https_fn.on_request()
   def a(req): ...
   # a.__firebase_endpoint__.cpu == None
   
   options.set_global_options(region="europe-west1")
   
   @https_fn.on_request()
   def b(req): ...
   # b.__firebase_endpoint__.cpu == "gcf_gen1"

   From reading firebase-tools, a 256MB function then gets less than one CPU and a concurrency of 1 instead of 80.

2. The minimum Python version is 3.10, which Cloud Functions deprecated on 2026-10-04 and will decommission on 2027-04-04. Raising the minimum to 3.11 is a breaking change. Separately, 3.14 is missing from the classifiers and CI, although the tests pass on it.

3. The auth blocking event times (AuthBlockingEvent.timestamp and the user metadata times) have no timezone, while other events' times include one. They are built with datetime.utcfromtimestamp, which Python 3.14 warns will be removed. Making them timezone-aware breaks comparisons with datetimes that have no timezone.

4. The Pub/Sub Message types don't match the values passed to the handler. publish_time arrives as a datetime, ordering_key can be None, and a message without data raises a TypeError before the handler runs. fix(pubsub): accept messages without data #322 fixes all three.

5. Adding before_email_sent and before_sms_sent will require AuthBlockingEvent.data to become optional, as it is in the Node SDK. That will break type-checked code that reads event.data.uid.

6. VPC, schedule and task options are not reset when preserve_external_changes is false. Node emits vpc: null, timeZone: null and retryConfig/rateLimits fields as null, and firebase-tools only clears a value when it sees null. Python omits the keys, so a VPC connector, schedule timezone or task rate limit set in the console survives a deploy today. Matching Node would remove those on the next deploy.

7. on_task_dispatched never checks the request's auth. Node rejects dispatches without a Bearer token outside the emulator and fills request.auth from the OIDC token. Matching Node means callers that work today start getting 401.

8. StorageObjectData.size, generation and metageneration are annotated int but arrive as str, because proto3 JSON encodes int64 as a string. remote_config_fn.ConfigUpdateData.version_number and rollback_source have the same problem. Confirmed with google.events.cloud.storage.StorageObjectData.to_json() and the Node SDK's own fixture, not with a live event. Either fix breaks someone: converting to int breaks code doing string operations, and changing the annotation to str breaks type checks for code that trusted int.