Document policy for pinning / upper+lower bounding dependencies

[JamesKunstle]

Across our project we have upper and lower bounds on dependencies. In general, we try to minimize and avoid conflicts between the version requirements of the libraries and the CLI. We should have a consistent policy for:
(1) under what circumstances we pin dependencies and
(2) under what circumstances (default?) we upper-bound dependencies.

[JamesKunstle]

@tiran

[nathan-weinberg]

This should be part of #1758

I also have a Dev Doc open relevant to this: instructlab/dev-docs#125