Do not make mitigations mandatory

[ChristophNiehoff]

When threat modelling, it is not strictly necessary to already come up with a mitigation. So, for some players it might be a unnecessary complication to have a mandatory mitigation field when entering a threat.

We should make this optional.