fix(stripe): enforce paymentMethodTypes allowlist

[stevencartavia]

The Stripe method advertised an allowed-payment-methods list but never enforced it.

• Challenge now uses the spec key paymentMethodTypes (was paymentMethods)
• verify sends payment_method_types to Stripe instead of automatic_payment_methods, so only allowed methods can charge
• payment_methods: is now required (raises ArgumentError if missing/empty)

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}