Move threat model doc to GitHub

Move threat model doc to GitHub
Good question. I'm not sure who wrote the doc initially, but maybe @dolanjs can comment?