[Remote] Add threat model diagram and content for remote self hosted scenario

[kvenkatrajan]

Add threat model diagram and content for remote self hosted scenario

Additionally add blurb to : https://github.com/microsoft/mcp-pr/blob/docs/docs/azure-mcp/threat-model.md

[kvenkatrajan]

In Review

Full document on my branch: mcp-pr/docs/azure-mcp/threat-model.md at users/vukelich/httpthreatmodel · microsoft/mcp-pr
My changes specifically: Updated threat model for 2.0-beta remote MCP server. · microsoft/mcp-pr@534bcf8

[kvenkatrajan]

@vukelich - please update the document with the following changes/suggestions from the review-

• For step 5, we should update this to mention FIC-PROXY, and also include it in the documentation for end-users. Else the server is limited to interact with a maximum of 20 FICs
• Add do not support Agent Identity for now
• Add text on Incoming Auth section to say that we are using Microsoft.Identity.Web

[kvenkatrajan]

https://github.com/microsoft/mcp-pr/pull/151 - PR in review

[anuchandy]

As of Jan/20 - requested @xiangyan99 and @ LarryOsterman to help organize the AZMCP 2.0 GA security review.

The 2.0 GA release is primarily focused on delivering a stable “remote” build of the November 2025 Ignite stage demo. The remote-specific threat model reviewed during the 2.0-beta security review is documented in this section - https://github.com/microsoft/mcp-pr/blob/users/vukelich/httpthreatmodel/docs/azure-mcp/threat-model.md#streamable-http-transport