Draft: simple update description guidelines

[Kevin Kofler]

Dominik 'Rathann' Mierzejewski wrote:
>> * If there are downstream bugs being fixed or intended to be fixed with
>> an update, it must be referred within the update. Maintainers can choose
>> to let bodhi auto close bugs or close it manually as well.
> 
> This is redundant. bodhi has a field for bug numbers and it's pretty
> self-explanatory.
> 
>> * For security update, add CVE information, if one exists.
> 
> As above.

Yet some maintainers fail to fill in that information (and this is also the
claimed reason security updates need approval from the security team). So
it can't hurt to spell this out.

        Kevin Kofler