A restaurant in Toronto doing a fixed-price brunch wants my card details so they can charge in case of no-show etc.

Fair enough, lots of restaurants do that.

But they want me to insert text boxes into a PDF, sign it, and email it back with a scan of the same credit card.

No restaurant's that good.