doc: add policy for landing new npm releases

This change in policy sets clear terms for when / how npm releases
can be landed into master and how long they are expected to bake in the
ecosystem. This is to cover all release types of npm including semver-major
releases.

What Node.js releases the updates land into are at the discretion of the
release team.

PR-URL: https://github.com/nodejs/node/pull/21594


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>