Move threat model doc to GitHub

Move threat model doc to GitHub
Overall the format of the threat model (see the [Pond Threat Model](https://pond.imperialviolet.org/threat.html), which we're using as a template here) should be:

1. Assumptions about components of the system
2. What various attackers can do given those assumptions

It seems like this document has the attacker's capabilities and the assumptions mixed together quite a bit. Assumptions should be invariant and stated directly, e.g. "RSA works". Stuff like "The organization may be forced to collude with a government agency to prevent document submissions and attempt to deanonymize sources. This could happen without the knowledge of any third party." is not an assumption, it's a description of an attacker (and one that needs to be much more detailed, due to the variety of possible things the org could be compelled to do).