docs: re-baseline THREAT_MODEL.md against S2-075 to S2-078

[lukaszlenart]

THREAT_MODEL.md §12 makes every published bulletin a re-baseline check: a bulletin whose class is not already a §8 property means the model under-describes the framework. This is that check for the four bulletins published on 2026-10-05.

Bulletin	Class	Outcome
S2-075	OGNL injection	§8.1 already covers it; recorded as evidence on the open §14 Q-default question (an opt-in legacy component, 7.x affected only with the allowlist disabled)
S2-076	Response amplification	New — §8.7 covered unbounded reads and retention, not a small input driving unbounded output; §8.7 widened
S2-077	Unbounded body read	§8.7, the S2-072 class in the REST plugin
S2-078	Cross-request shared state	§8.6; wording widened to mutable objects reused from framework caches

Also in this pass:

• §5a records the 7.4.0 / 6.12.0 controls — the REST body bound (struts.rest.content.maxLength), the isolation interceptors in the REST and Bean Validation plugin stacks, action-name validation in the legacy restful mapper — which fire §12's first trigger independently.
• Correction: §5a and §8.5 described FetchMetadata / COOP / COEP as opt-in. They have been in core's defaultStack, enabled, since 6.0.0 (COEP in report-only mode) — verified in struts-default.xml at STRUTS_6_0_0, STRUTS_6_12_0 and STRUTS_7_4_0.
• §16 gains an S2-075 … S2-078 table beside the S2-070 … S2-074 one; the header's Last revised and the version binding are updated.

Nothing here goes beyond what the bulletins themselves publish.

🤖 Generated with Claude Code