Move threat model doc to GitHub

Move threat model doc to GitHub
It should probably be in a separate section though, see my recent PR comments.