Add support for the "payment" feature in Feature Policy.

The feature hasn't been defined yet in FeaturePolicy.cpp. It should be defined there, and checked before allowing the use of Window.PaymentRequest.

If disabled in a frame, the constructor should throw a SecurityError
See: https://github.com/w3c/browser-payment-api/issues/2
Also see: https://w3c.github.io/browser-payment-api/#constructor

Also complicating this is that we need to ensure that the allowpaymentrequest iframe attribute is *also* supported, since it has already shipped. This is an alternative method, but the original method should still work in the absence of a Feature-Policy header.