Exclude End-to-End Signing and the Maximum Security Model

* Cover more of TUF's design in the PEP.
* Simplify diagrams of both the Minimum and Maximum Security Models.
* Add threat model.
* List repository attacks prevented by TUF.
* Convert the table in the `Key Compromise Analysis` section to restructuredText.
* Discuss the two-phase design (recommended by Nick).
* Add sections for auditing snapshots and recovering from a repositiory compromise.
* Add diagram outlining the metadata roles in TUF.
* Reorganize the PEP.
* Exclude discussion of the maximum security model and End-to-End Signing.