Move threat model doc to GitHub

Move threat model doc to GitHub
"communications" is vague. We've been calling communications from the source "submissions" and communications from the journalist "replies".