Document policy regarding backports of dependency updates

[spiffxp]

Prompted by kubernetes/kubernetes#94367 getting cherry picked with no explicit documentation as to why

From this slack thread with @justaugustus

We commonly backport deps in the same minor stream
[The policy is] handwavy, needs to be written this cycle
The plan is to extend out from this Golang handbook (merged PR): #1109

/sig release
/area release-eng
/kind documentation

[justaugustus]

/assign
/priority important-soon
/area dependency

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale