Tweak wording of Rust crate dependency update policy.

[reivilibre]

After looking into it, just a couple of things to pick a bone at in the old wording,
which I thought could be clarified for when I next come to look at this again.

• the claim that there's a fundamental difference; I'd argue there isn't really, it's just by convention
  on some mainstream distros. So I have changed this to 'typically'
• statements that some distros fetch dependencies at build time (probably does happen, but
  traditional distros make a point of not doing this for the reasons you'd expect).
  • This was probably meant to be talking about Debian, but my observation based on sample size of 3 is that some crates are packaged natively, others are vendored in the respective application's source package (like they do for us) and sometime they patch the bounds a bit

There could probably be room to talk about how distros vendoring packages is a maintenance burden on them,
but I guess it's a bit moot as we would struggle to conform to wide enough bounds to make everyone
happy (and anyway; I expect the distros that vendor packages have the tooling to make this easy to
update and we do keep on top of security updates and release frequently...)

---

Spawning from discussion in #element-backend-internal:matrix.org