Write a dependency policy

We should have a written policy about what versions of dependencies we will support.

A good rule of thumb is probably what the current LTS releases of the major Linux distributions (Debian, RedHat, Ubuntu) provide.