doc: Add a note about backporting

See laanwj's comment in #17158
bitcoin/bitcoin#17158 (comment)

Co-Authored-By: Wladimir J. van der Laan <[email protected]>
Co-Authored-By: Hennadii Stepanov <[email protected]>
Co-Authored-By: João Barbosa <[email protected]>
Co-Authored-By: Michael <[email protected]>
Co-Authored-By: Luke Dashjr <[email protected]>

Author: 6 people

CONTRIBUTING.md

@@ -309,6 +309,31 @@ about:
     when someone else is asking for feedback on their code, and universe balances out.
 
 
+Backporting
+-----------
+
+Security and bug fixes can be backported from `master` to release
+branches.
+If the backport is non-trivial, it may be appropriate to open an
+additional PR, to backport the change, only after the original PR
+has been merged.
+Otherwise, backports will be done in batches and
+the maintainers will use the proper `Needs backport (...)` labels
+when needed (the original author does not need to worry).
+
+A backport should contain the following metadata in the commit body:
+
+```
+Github-Pull: #<PR number>
+Rebased-From: <commit hash of the original commit>
+```
+
+Have a look at [an example backport PR](
+https://github.com/bitcoin/bitcoin/pull/16189).
+
+Also see the [backport.py script](
+https://github.com/bitcoin-core/bitcoin-maintainer-tools#backport).
+
 Release Policy
 --------------