[Spec] Only allow show() to be called in a foreground tab (#1005)

This addresses this issue in SPC - https://w3c.github.io/secure-payment-confirmation/#issue-e92619e9

The behavior spec'd in SPC appears to already be followed in general Payment Request implementations already, based on testing in both Safari and Chrome, so it seems safe to just spec it here instead.

index.html

@@ -839,6 +839,9 @@ <h2>
           not [=Document/fully active=], then return <a>a promise rejected
           with</a> an {{"AbortError"}} {{DOMException}}.
           </li>
+          <li>If |document|'s [=Document/visibility state=] is not `"visible"`,
+          then return <a>a promise rejected with</a> an {{"AbortError"}}
+          {{DOMException}}.
           <li>
             <p>
               Optionally, if the <a>user agent</a> wishes to disallow the call