Merge pull request #352 from potiuk/asf-security/draft-threat-model-2026-05-30

Add draft project security threat-model document