Document the release process

[SteveLasker]

What is the areas you would like to add the new feature to?

Go-COSE Library

Is your feature request related to a problem?

We are currently working out of main, where all approved/merged updates are pushed to main. As a new release is queued, we stabilize out of main. This has served us well thus far. Open question:

• Do we anticipate stabilizing a release, while developing a new version concurrently? This may require a more complex branching strategy.
• Do we believe we can work around our stabilize in main process?

Either way, we should document the current working process.

[OR13]

This is blocking the next minor release... and fixes to :

• https://github.com/veraison/go-cose/issues/181

[OR13]

I recall based on our previous meeting, we said our policy should be:

Release Policies

• Folders for release polices
• Minor releases are reviewed by maintainers
• Major release follows the same policies as minor
  • We may do a third party audit, and would require it to be published before the release
  • We reserve the right to not do the audit, if the maintainers believe the costs of the audit aren't justified based on the capabilities added or bugs fixed.