refactor: Extract store package (#100)

Now that we've cleaned up `database.go` a bit, it looks like a good
candidate for extraction into its own package. This makes it easier to
test and explain to new contributors.

I named the package `store` because `firestore` would have collided with
the actual Firestore client package and `fs` would have collided with
the actual standard library filesystem package. We can re-refactor into
a better name if we find one!

Some extra changes I made along the way:
- Rename `FirestoreFooDB` to `store.FooClient`
- Scope SecretsClient to its one collection
- Extract a `pbtest` package now that the test Firestore client is used
in two test packages.
- Use our new `assert.Equal` helper instead of defining `.Equal` methods
on DB structs.