add requirements on transaction data

[Sakurann]

          discussed in the WG. QES probably out of scope since it is eIDAS construct. payments is global. would be worth calling payment type explicitly. will open an issue to discuss implications of mandating any of the types.

from @leecam: "As a datapoint we did implement this without any SE changes. The security assurance is just the same as what you get when asserting the device key for the normal presentation"

will remove this requirement for now and put a placeholder that some of the types are likely to be recommended

Originally posted by @Sakurann in #122 (comment)