Add threat model

[ghost]

Once we have a clearly written out security/threat model, we should document it. Not sure if this should live here or in libp2p/libp2p, but it should live somewhere and be pointed to in the docs as an advanced topic. Some users care a lot about this topic and it can't just be self-documenting in the code. Self-assigning.

[p-shahi]

This issue is resolved by https://docs.libp2p.io/concepts/security-considerations/ and in part by https://docs.libp2p.io/reference/dos-mitigation/