feat(lab2): STRIDE threat model + secure variant diff via Threagile

[Wilikson173]

Goal

Generate a STRIDE-based threat model of OWASP Juice Shop with Threagile, produce a hardened secure variant, and diff the risk reports to quantify the impact of four targeted hardening changes.

Changes

• labs/lab2/threagile-model-secure.yaml — hardened variant of the baseline model: HTTPS on all communication links, AES encryption on Persistent Storage, IP filtering on the outbound WebHook
• submissions/lab2.md — risk count tables (baseline vs secure), top-5 risks with STRIDE mapping, trust-boundary observation, diff analysis, and honesty check

Testing

# Generate baseline report
docker run --rm \
  -v "$(pwd)/labs/lab2":/app/work \
  threagile/threagile:0.9.1 \
  -model /app/work/threagile-model.yaml \
  -output /app/work/output

# Generate secure-variant report
docker run --rm \
  -v "$(pwd)/labs/lab2":/app/work \
  threagile/threagile:0.9.1 \
  -model /app/work/threagile-model-secure.yaml \
  -output /app/work/output-secure

# Baseline: elevated=4, medium=14, low=5 (total 23)
jq '[.[] | .severity] | group_by(.) | map({severity: .[0], count: length})' \
  labs/lab2/output/risks.json

# Secure: elevated=2, medium=13, low=5 (total 20)
jq '[.[] | .severity] | group_by(.) | map({severity: .[0], count: length})' \
  labs/lab2/output-secure/risks.json

Artifacts & Screenshots

• submissions/lab2.md — full analysis with risk tables and STRIDE mapping
• labs/lab2/threagile-model-secure.yaml — hardened Threagile model

---

Checklist

• Title follows feat(labN): <topic> style
• No secrets or large temp files committed
• Submission file exists at submissions/lab2.md