Move threat model doc to GitHub

Move threat model doc to GitHub
I'm not sure who wrote the doc initially, but maybe @dolanjs can comment?