docs: add deps policy in README (#43)

Author: loicsikidi

README.md

@@ -241,6 +241,20 @@ The following TPM devices have been successfully verified using `tpm-trust audit
 >
 > *Why?* Internally, `tpm-trust` uses `tpm-ca-certificates` library to always get the latest trust bundle.
 
+## Dependency Update Policy
+
+> [!NOTE]
+> For those interested in understanding the motivations behind this approach, I recommend reading [Filippo Valsorda's thoughts on Dependabot](https://words.filippo.io/dependabot/).
+
+This project does not rely on automated dependency update tools like Dependabot. When managing multiple projects in parallel, such tools generate more noise than value.
+
+Instead, this project follows a pragmatic, security-first approach:
+
+1. **`govulncheck` runs daily** to detect vulnerable dependencies. When a vulnerability is identified → we bump the affected dependency.
+2. **Feature-driven updates**: Dependencies are updated when the project needs a new feature or capability provided by a newer version.
+
+This approach balances security with intentionality, ensuring updates happen for concrete reasons rather than on autopilot.
+
 ## Development
 
 ### Prerequisites