In one of the few decisions of its kind in a consumer data breach case, a federal judge certified classes of former Marriott guests, allowing potential damages under the theory that guests overpaid for their hotel stays.