Update the release requirements policy

[mattcaswell]

We should update the release requirements policy to ensure that things which are more recommendations are stated as such, rather than as requirements.

For example, it currently says "The tree must be frozen for at least 7 days.". This probably ought to be a "should" rather than a "must". It is best practice to do it. But not necessarily a blocker on the release if it has had less than 7 days.

https://openssl-library.org/policies/technical/release-requirements/