env reserved prefix handling

[Berlioz]

The EXT_SELECTED_EVENTS allowed prefix wasn't working because it's semantically different than FIREBASE_SECRET_REF_ and FIREBASE_MIGRATED_SYSTEM_ prefixes that need something after the underscore.

[gemini-code-assist]

Code Review

This pull request refactors environment variable key validation for Firebase Functions. It introduces a helper function keyPermittedByKnownPrefix to validate allowlisted reserved prefixes, throwing errors if they are malformed (e.g., missing a required suffix or having an unexpected suffix). It also updates the corresponding unit tests and adds explanatory comments. The reviewer suggested refactoring keyConflictsWithReservedPrefixes to avoid nested .some() calls with a throwing predicate, recommending a flatter loop structure to improve readability and align with the repository's style guide on reducing nesting.

[ajperel]

Have some message/comment suggestions but code looks good.