doc: Add a note about backporting

See laanwj's comment in #17158
https://github.com/bitcoin/bitcoin/pull/17158#issuecomment-542627090

Co-Authored-By: Wladimir J. van der Laan <laanwj@protonmail.com>
Co-Authored-By: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>
Co-Authored-By: João Barbosa <joao.paulo.barbosa@gmail.com>
Co-Authored-By: Michael <fanquake@gmail.com>
Co-Authored-By: Luke Dashjr <luke-jr+git@utopios.org>

CONTRIBUTING.md

@@ -309,6 +309,31 @@ about:
     when someone else is asking for feedback on their code, and universe balances out.
 
 
+Backporting
+-----------
+
+Security and bug fixes can be backported from `master` to release
+branches.
+If the backport is non-trivial, it may be appropriate to open an
+additional PR, to backport the change, only after the original PR
+has been merged.
+Otherwise, backports will be done in batches and
+the maintainers will use the proper `Needs backport (...)` labels
+when needed (the original author does not need to worry).
+
+A backport should contain the following metadata in the commit body:
+
+```
+Github-Pull: #<PR number>
+Rebased-From: <commit hash of the original commit>
+```
+
+Have a look at [an example backport PR](
+https://github.com/bitcoin/bitcoin/pull/16189).
+
+Also see the [backport.py script](
+https://github.com/bitcoin-core/bitcoin-maintainer-tools#backport).
+
 Release Policy
 --------------