But is "and" being used to form a set of acceptable forms of identification (any of which would be sufficient), or is it joining the forms of identification together as all being required?

It's joining them all together, but the whole thing is presented as an example. Any avenue that provides the ability to contact presumably meets that standard.

If Shopify were to alter their contact info requirement, it would clearly be with a different goal in mind than the one laid out in that sentence. That's assuming of course, that the current requirements have actually led to communication.

Coming back to add, I think the following sentences have identical meanings:

"Acceptable forms of identification include driver's license, passport, and birth certificate."

"Acceptable forms of identification include driver's license, passport, or birth certificate."