F.A.Q. about pinning packages

Me and @JeffersGlass had a very lengthy conversation in Discord that started here: https://discord.com/channels/972017612454232116/972020206538997822/1250818968466362378

It's clear people using PyScript don't (know or ...) pay enough attention to the pinned version of a module concept, so that it's expected from them to be surprised when we do a release, we update our interpreters, and stuff suddenly break for everyone that didn't get the "pin your package" memo.

The issue gets bigger when packages like Bokeh require, and maybe even provide, their own CDN to make it work.

In that case, the user had Bokeh 2.4.2 pinned as <script ...> dependency on their Web page, but no pinning version whatsoever in their packages = ["bokeh"] configuration.

We don't expect neither Pyodide nor MicroPython to change behavior around grabbing whatever latest stable version of a package there is, when no versioning is provided, but definitively we should inform our users the moment they don't pin a package version, specially if there is a JS counter part to satisfy that version, stuff might break unexpectedly (and it's not our fault, or Pyodide or MicroPython fault, it's a documentation fault, imho).

The issue names no target file, test, or entry point; begin by locating the FAQ or package-configuration guidance in this documentation repository. Done means adding clear guidance that users pin package versions, including the Bokeh case and matching JavaScript/CDN versions, and explaining the consequences of leaving versions unspecified.