Clarify versioning/update policy in the README

Breadcrumbs for down the road... (Mostly for myself).

Context
- Docker Official images and what that means
- Base image updates (eco-system rebuilds)
Nextcloud Server releases (upstream bumps)
Image releases
- bugs fixes
- enhancements
- upgrades of underlying bits (e.g. a new major PHP or underlying distribution version)

Production Docker tags:

Tracking this in: #2265

Immutable:

No such thing technically since what a tag points to can always be changed
We attempt to make specific tags semi-immutable at the Dockerfile level, but the images themselves referenced by these tags will technically always change automatically whenever the underlying base images (debian, alpine, php) are updated (generally for security). This is a byproduct of how Docker base images and Docker Official images work.
The only truly immutable option - if you require that - is to reference your images by their digest. The caveat being you're 100% responsible for security updates.

General recommendations:

Pin your image references to something. Rule of thumb: a major release or one of { latest, previous, last }

Tagging policy
- latest/previous/last match upstream
- stable/production generally matches ?

Changelog:

nextcloud / docker