Publish a document targeting maintainers explaining how they can get package changelogs auto-pulled into Dependabot

[jeffwidman]

I noticed a recent Dependabot PR of a popular project is missing the changelog and release notes sections:

• Bump flake8 from 5.0.4 to 6.0.0 in /python/helpers #6218

This happened to be a major version bump, indicating breaking changes. While hunting down the release notes, I happened to notice that the maintainer had temp closed the issue tracker to reduce folks filing tickets because things don't work anymore:

• I'm temporarily disabling the issue tracker PyCQA/flake8#1760

Having the release notes / changelog front and center in the Dependabot PR's helps not only our users, but also maintainers because users are more likely to see the notes before they file a new issue. For example, contrast the above PR with this which makes it super easy to see release notes / changelog:

• Bump licensed from 3.9.0 to 3.9.1 in /updater #6219

I was going to email the flake8 maintainer, when I realized we should really have a public doc we can link to that shows maintainers how to more easily expose their projects metadata in a way we expect.

The metadata fetch process will vary by ecosystem, so ultimately we should have a few notes and then link to that ecosystem's package index doc on how to expose metadata... but I expect some package index docs don't have a doc like that, so it's an opportunity for us to work with them to create one. That will help those entire ecosystems, not just Dependabot.

[jeffwidman]

also document the changelog for docker that @mctofu just landed... requires maintainer to add OCI tag...