Scenario of Use Scheme: Threat Model Specification for Speaker Privacy Protection in the Medical Domain