cybersource:  Check that payment_method_or_reference is not a string before getting the card brand

Looks like this was introduced in 1.31.0  card_brand does not handle reference strings, so a check needs to be made before calling it.