Write up threat analysis

[aaronpk]

Write up a threat analysis per Speeding Up Security Reviews by Mozilla

[Zegnat]

Now that we are continuously trying to bring IndieAuth more inline with default OAuth, should we consider refering people to the general OAuth threat models?

• RFC 6819: OAuth 2.0 Threat Model and Security Considerations
• Security Consideration - OAuth 2.0 Simplified