Document procedure for updating build requirements

[conorsch]

We recently rebuilt a few wheels for #239, and the process went rather smoothly. One call-out worth discussing further is that CI checks on the component repos were overridden, as documented in #240 (comment)

Since the CI config in this packaging repo references requirements files in the component repos, and the CI configs in the component repos clone in tooling from the packaging repo, the inter-dependence will cause CI to get out of sync, particularly when updating build-requirements.txt files. So, what to do about it? We have a few options:

1. Accept the friction, document it clearly, and continue onward with no changes.
2. Adjust the branch protection settings so that any SecureDrop Maintainer can selectively override merge when required.
3. Adjust the packaging repo CI to check for a special branch on the component repos, e.g. update-build-requirements, and check that out if it's found.

Those are just a few options, but we'll likely identify more with a bit of discussion. @kushaldas I tried to capture some of your comments from standup today above, but would like to hear more. Also @creviera, particularly interested in your candid thoughts on the workflows involved here.