[zep noup] doc: add document to explain how version bumping should be handled

This commit introduces a document which describes how version bumping to
upstream Mbed TLS' releases should be handled in the Zephyr's fork of
Mbed TLS.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>

Author: valeriosetti

version-bumping.md

@@ -0,0 +1,37 @@
+Scope of this document
+======================
+
+Explain how to update Zephyr's fork of Mbed TLS to align with a newer upstream
+release.
+This document talks about Mbed TLS, but the very same applies also to
+TF-PSA-Crypto that, starting from Mbed TLS release 4.0, will be part of the
+Mbed TLS project.
+
+Upstream Mbed TLS branches and tags
+===================================
+
+- Working branch name: `development`
+- 1 or more LTS branches named as `mbedtls-<major>.<minor>` (ex: `mbedtls-3.6`)
+- Tag at every release with format `v<major>.<minor>.<patch>` (ex: `v3.6.4`)
+
+Proposed approach
+=================
+
+Let's say that a new Mbed TLS release is announced and that its release tag
+is for example `v3.6.5`.
+On the Zephyr fork:
+1. Create a new branch named `zephyr-mbedtls-v3.6.5` which is located exactly at
+   the upstream release tag.
+2. Make a PR by cherry-picking all the Zephyr extra patches that are still valid
+   for the new branch [1]. For this PR set the target merge branch to the newly
+   created `zephyr-mbedtls-v3.6.5`. [2]
+3. Wait for the PR to be merged.
+4. Set the repo `default` branch to `zephyr-mbedtls-v3.6.5`.
+
+[1]: Likely all the `[zep fromtree]` (and perhaps `[zep fromlist]`) should be
+     discarded as they should already be included in the new upstream release.
+     Others (i.e. `[zep noup]`) might no more be valid or might require an
+     update. In general each Zephyr extra patch should be checked individually.
+
+[2]: With this approach the PR in GitHub will show only Zephyr extra commits
+     on top of the upstream release tag, so it will be easier to review.