allow threat model JSON to specify a list of criteria under a countermeasure when a criteria-group is not needed

[kristovatlas]

This would improve the human readability of the threat model JSON and would be backward compatible.

I think it would also be easier for newcomers to the schema to understand, as the intro documentation can first present the idea of specifying a list of criteria and then present the option of using criteria-groups if required.