Document Sling threat model and how to properly secure Sling

The documentation should be more explicit about to run sling in a secure way. In particular we should provide some information about the underlying threat model.

For example we should be being explicit about the fact that whoever has access to the OSGi console has file system access with the privileges of the JRE.

cc: rombert, cziegeler