Restrict MIME types of Web Payment App navigation

[maxlgu]

Currently, Web Payment App does not have restrictions on the MIME types of its navigation. This makes it possible for the payment apps to navigate to, for example, PDF, which is lesser used and supported in payment handler. This unnecessarily exposes payment handler API to the vulnerabilities of these surfaces. Thus, I suggest restricting the MIME types of navigations so as to reduce the security attack surface. For example, we can allowlist the following MIME types:

• text/*
• image/*
• video/*
• application/javascript
• application/xml
• application/json

[maxlgu]

@rsolomakhin @danyao

[rsolomakhin]

I think that's a good idea.