Document module dependency pinning

[slint]

We're notoriously inconsistent regarding the version capping on modules, and I can understand that since there are good pros/cons for either choice, the major ones being:

• ✅ Better stability: capping prevents modules from breaking when we release breaking changes (i.e. major bump) on the dependency
• ❌ More work: without the tests breaking when a dependency has breaking changes, we'll never find out the impact of a breaking change unless we manually check each module that depends on it

I've found a mix of capped/uncapped across base Invenio and RDM modules. Maybe a general "pattern" is that the higher up in the chain a module is or the more critical its dependencies are, the more likely they're capped:

• rdm-records
• records-resources

I would say given past situations, capping is a more stable alternative that helps also with overall developer experience.

Originally posted in https://github.com/inveniosoftware/cookiecutter-invenio-module/pull/147#discussion_r1104131019