Add draft security threat model (THREAT_MODEL.md) + discoverability pointer

[potiuk]

What this is

This is a proposal for the Struts PMC to review, correct, reject, or adopt — not a finished document and not an obligation. It adds a draft THREAT_MODEL.md for the Apache Struts framework, plus a one-paragraph pointer to it from SECURITY.md, to improve the project's security-model discoverability for automated security scanners and for triaging inbound reports.

It was drafted at the PMC's request (path: "the Security team drafts a v0, the PMC reviews and owns it").

What it does

• THREAT_MODEL.md (new) — a structured model: scope and intended use, trust boundaries, adversary model, the security properties the framework provides vs. those it leaves to the embedding application, a known-non-findings list, and a triage-disposition guide. It is built as a strict superset of the existing SECURITY.md and the published security guidance and links to them rather than duplicating their content (knob lists, reporting process, and developer-responsibility detail stay canonical in those docs). The central framing follows the project's own words — Struts "doesn't provide any security mechanism — it is just a pure web framework" — with OGNL-injection / parameter-binding containment as the property the framework actively defends.
• SECURITY.md — adds a short "Threat Model" section linking to the new file, so the existing AGENTS.md → SECURITY.md → THREAT_MODEL.md chain resolves. No existing content is changed or removed.

How to review it

Every load-bearing claim carries a provenance tag — (documented) (from your own docs / SECURITY.md / security site), (maintainer) (to be filled in as you confirm), or (inferred) (reasoned, not yet ratified). §14 collects the open questions — the fastest way to review is to react to those; each (inferred) claim has a matching question. Anything you correct, we fold in; anything you reject, we drop. The model is versioned with the project and is meant to live in the repo for the PMC to maintain.

Nothing here changes framework behaviour — it is documentation only.