Document our policy for Rust dependencies

We should document what our (experimental, subject to change) policies are w.r.t. new Rust dependencies in tor, somewhere in the doc/HACKING/ directory.