Threat Evaluation Improvements: Simplify conditions and first step toward detecting mitigations

When using pytm to find threats I found most threats do not apply which would require me to re-write conditions to detect applicable components. Instead to address this I added a new condition to the threatlib called 'target_condition" to detect if the target is relevant for the Threat. For example using INP01 : Buffer Overflow via Environment Variables I have a target_condition of 'target.usesEnvironmentVariables' with the 'condition' of target.sanitizesInput is False and target.checksInputBounds is False another example would be applying SQLi to a Server or Process only if one of the outbound data flows as a sink of Database and isSQL = True.

This is basically what I was getting after with #14 although i described it differently.

To be able to see this in report and ensure the target conditions are valid I have taken a step towards detecting mitigations. When applying a threat I have created a ThreatResult class for invalid target, not applicable threats (target_condition = False), mitigated (target_condition == True and condition == False) and Valid. Added lists of Threats for na, mitigated threats in Element.

Things are mostly functional locally but still playing with a few things. I would like to get anyones thoughts as I continue with this.

Start by reading the issue discussion and the existing threatlib and Element handling referenced in the proposal. Confirm the intended target_condition and ThreatResult behavior with maintainers; done requires an agreed implementation that distinguishes invalid, not-applicable, mitigated, and valid threats and exposes the requested results.