Draft a version-pinning advice for downstream projects

[leofang]

We don't want people to pin any of our projects too tightly that results in version conflicts between packages. We need to give advices.

[leofang]

Current thought after discussing with @brycelelbach: For packages that depend on the compiler (NVCC, numba-cuda, or cutile-python in the future), they should agree on a lower bound of the compiler version, and the compiler should in turn loosely pin a set of packages that it needs. We might want to consider collectively bumping the lower bound when a new CUDA major (or minor?!) release is out. Let me raise this discussion in the Python wg.