docs: threat model for node (#24465)

Adds a new `THREAT_MODEL.md` doc. This document describes the threat
model of the Aztec L2 network: how transactions flow from users into the
proven chain, what each participant can and cannot do, and the
properties the implementation must uphold. It is intended as a guideline
for the security of the node implementation (`yarn-project`) and its
interaction with the L1 rollup contracts (`l1-contracts`).

**In scope**: transaction dissemination and the mempool, the p2p layer,
block and checkpoint production, committee attestation, L1 checkpoint
submission and sync, epoch proving, slashing, and the escape hatch.

**Out of scope**: client-side private execution and proving (PXE,
wallets), hardening of a node's public RPC interface, the cryptographic
soundness of the proving system itself (treated as an assumption below),
and L1 governance internals.

Author: spalladino