Describe known active attacks

[chris-wood]

Addresses #229.

This is for motivating some of our design decisions (and documenting what we know along the way). I meant to do this a while ago, but never got around to it. In particular, it describes why we have the following three bindings:

1. Transcript to ECHO secret (to prevent client reaction attacks).
2. CH1 to CH2 (to prevent HRR oracles).
3. ClientHello to resumption PSK binder (to prevent resumption oracles).

I'm sure the language and presentation can be improved, so suggestions to that effect are very much welcome!

cc @martinthomson, @davidben, @dmcardle, @jhoyla, @kazuho, @karthikbhargavan, @grittygrease

[chris-wood]

Thanks for the feedback! I incorporated your suggestions and clarified a few more things. I'm merging as-is since they seemed mostly editorial.