It seems to me like you could put arbitrary data into a transaction payload, since it is JSON. Is this true, can a sender add additional fields to the transaction JSON? Or if thats not possible, could a sender put an arbitrary program into the scriptPubKey?
For example, ScriptPubKey could be
OP_DUP <myArbitraryData> OP_DROP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG, which would put some arbitrary data on the stack and then pop it off the stack right away again, which wouldn't influence the result of the script but would let the sender include arbitrary data in the transaction.