fix: Throw error on user disabled and check revoked set true

[xil222]

Add the logic to throw error in verifySessionCookie and verifyIdToken when user disabled and checkRevoked is true.
The logic might not look most efficient, but it is rather a simple approach without changing logic and breaking other tests.

RELEASE NOTE: When checkRevoked is set to true, the verifyIdToken() and verifySessionCookie() APIs now throw an error if the user record is disabled.

[hiranya911]

Needs a bit of refactoring to make sure we don't call getUser() more than once. But mostly looks pretty good.

[hiranya911]

The integration test passed for me without currentUser.reload(). Can we try that out with our CI and see what happens?

[hiranya911]

LGTM 👍

[egilmorez]

A few style things to look at, thanks!