added Kerckhoff's Principle to Bibliography

Big problem of appsec today is that we don't build applications with
Kerckhoff's in mind; unless it is OWASP AppSensor. ;-)