Define the feature policy for the Payment Handler content

[anthonyvd]

@marcoscaceres Raised the point that the spec should define the feature policy in the Payment Handler window. Mozilla is concerned about showing web remote content in what appears like browser UI without that feature policy defined.

[marcoscaceres]

This also puts a hard/normative dependency on having the UA implement feature policy (or something like it, as the developer won't have control over it)... we then need to consider what's in, what's out and let respective browser's security teams look over that.