Update README from changes in VCALM

[eric-schuh]

@TallTed gave a number of suggested updates to the README file in the VCALM threat model work. They should be pulled into the main repo.

specification. It need not be in the body of the specification itself, but it should

be a good run down of what contributors need to do to help with threat modeling.

Originally posted by @TallTed in #655