Develop a security threat model for ArviZ

### Tell us about your idea

As a follow-up to our participation in GitHub's Secure Open Source Fund Session 3, I'd like to work out a threat model for security threats that ArviZ is facing.

### Thoughts on implementation

_No response_

### References

_No response_