Move threat model doc to GitHub

Move threat model doc to GitHub
I don't think we have enough info published here to back up saying that `The list is intended to be exhaustive` And we should be clear that this is an incomplete draft document.