Add information on updating dependencies

[varkor]

This would be useful to have as a subsection under "crates.io Dependencies". Updating a dependency is more frequent an occurrence than adding a new one, but one can still run into issues, e.g.:

error: cannot satisfy dependencies so `some_crate` only shows up once

[varkor]

This might include information on librustc_cratesio_shim.

[jieyouxu]

Triage: this issue is slightly too general nowadays, because how to bump deps depends on whose deps we're bumping and who needs to sign-off:

• std/core deps get bumped manually (e.g. libc) and will need T-libs reviewer sign-off and maybe reviews from libc/compiler-instrinsics maintainers to coordinate.
• compiler deps get bumped manually and will need T-compiler reviewer sign-off.
• bootstrap (bootstrap itself, tools, x, compiletest) deps need T-bootstrap reviewer sign-off; we don't auto bump bootstrap deps because sometimes that can introduce new undesirable deps which can cause significant build time regressions.
• infra deps (like bumping qemu versions) need T-infra reviewer sign-off.
• rustdoc and rustdoc-frontend deps need their own sign-off from T-rustdoc and T-rustdoc-frontend.
• wg-rustc-dev-guide dep bumps on itself should receive sign-off from WG-rustc-dev-guide maintainers.

Deps are also subject to tidy license checks to prevent new deps w/ incompatible licenses from being introduced into r-l/r. Note that dep bump processes for non r-l/r repos are subject to their own discretion.