Add dfn links for DC API and VC API references in threat model

[eric-schuh]

The threat model needs to be reviewed and proper links added for these terms.

We should use the proper names of things we know, like this. (Why don't DC API and VC API have dfn links? Or if they do, why aren't these instances linked?)

          any of the available interaction protocols advertised, such as the DC API if it is supported, and there are no restrictions 

Originally posted by @TallTed in #655