add curriculum on assessing risks (from Holistic Security?)

[mfc]

I was surprised not to find curriculum content on assessing risks. Holistic Security does have that content tho:

• https://holistic-security.tacticaltech.org/chapters/explore/2-8-identifying-and-analysing-threats
• https://holistic-security.tacticaltech.org/chapters/strategise/3-1-responding-to-threats

so it would be nice to port over, ideally someone with access to the Markdown of the Holistic Security content.