As mentioned in OWASP#239 AC22 Credential Aging review the threat AC22
Credential Aging was not helpful.

This commit replaces AC22 with two new threats AC23 Credential
Disclosure and AC24 Hardcoded Credentials.

AC23 checks if the lifetime of the credentials is LONG, MANAUL, or
UNKNOWN.
Currently there is no way to resolve this threat by changing the model,
besides setting the a different lifetime.

AC24 warns against the use of hardcoded credentials.

When a threat in `threats.json` has a `DEPRECATED` attribute the threat
will be ignored.
The value of `DEPRECATED` is irrelevant for pytm, but it can describe
the reason for the deprecation.