Move threat model doc to GitHub

Move threat model doc to GitHub
Generally I think it's valuable to separately discuss remote from physical attackers. These sections seem to conflate them. For example, you could theoretically use an exploit in Tor or Apache to gain RCE as the debian-tor or www-data user remotely. You could then try to privilege escalate to become root.

However, if you're local, you could just boot into single user mode and be root. Or you could perform a cold boot attack, etc. Both of those attacks are unavailable to remote attackers.