[w3c/payment-request] Changes stemming from privacy review (#856)

cc @plehegar, @swickr, @samuelweiler 

- Corrected bug by removing MUST language from the informative introduction.
- Corrected bug by aligning the definition of requestBillingAddress (under 9. PaymentOptions dictionary) to look like the other definitions (and include "SHOULD").
- Enhanced 19.6 Exposing user information by explaining more both the reason
  for PaymentMethodChangeEvent and the privacy implications. Enhanced the
  explanation by allowing for other ways to minimize data sharing, including
  an emerging idea for providing an "exclude" array (or similar) as payee
  request data that could be used by the payment method definition to
  limit which response elements are returned.

Relates to
 https://github.com/w3c/payment-method-basic-card/issues/72

The following tasks have been completed:

 * [x ] Confirmed there are no ReSpec errors/warnings.
 * [ ] Modified Web platform tests (link)
 * [ ] Modified MDN Docs (link)
 * [ ] Has undergone security/privacy review (link)
 
Implementation commitment:

 * [ ] Safari (link to issue)
 * [ ] Chrome (link to issue)
 * [ ] Firefox (link to issue)
 * [ ] Edge (public signal)

Optional, impact on Payment Handler spec?
  - Not so much Payment Handler API, but payment method good practice.
    https://github.com/w3c/payment-request-info/wiki/PaymentMethodPractice

If we merge this pull request, I would like to update that documentation to mention privacy protection around the event.
You can view, comment on, or merge this pull request online at:

  https://github.com/w3c/payment-request/pull/856

-- Commit Summary --

  * Changes stemming from privacy review:

-- File Changes --

    M index.html (65)

-- Patch Links --

https://github.com/w3c/payment-request/pull/856.patch
https://github.com/w3c/payment-request/pull/856.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/856