Updated Scrapy release procedure (markdown)

Scrapy-release-procedure.md

@@ -145,3 +145,14 @@ it, even though the GitHub online editor).
 ## Cherry-pick into master
 
 If you’ve released a patch version, you should cherry-pick the required commits into master (exclude version-bumping changes).
+
+## Upgrade CI packages
+
+To avoid the risk of CI suddenly failing and confusing pull request authors, we freeze some CI packages:
+
+- bandit
+- flake8
+- pylint
+- pytest-cov
+
+Right after a major or minor release would be a good time to update those packages, solving or allow-listing any issue raised by their new versions.