Clarify dependency policy between Cabal, cabal-install

HACKING.md

@@ -77,7 +77,13 @@ Dependencies policy
 Cabal's policy is to support being built by versions of GHC that are up
 to 3 years old.
 
-The development branch of the Cabal library must not depend on any library,
-or any version of any library, outside those that ship with GHC HEAD. All
-dependencies must be buildable with versions of GHC up to 3 years old
-(see above), but they need not ship with older versions of GHC.
+The Cabal library must be buildable out-of-the-box, i.e., the
+dependency versions required by Cabal must have shipped with GHC for
+at least 3 years. Cabal may use newer libraries if they are available,
+as long as there is a suitable fallback when only older versions
+exist.
+
+cabal-install must be buildable by versions of GHC that are up to 3
+years old. It need not be buildable out-of-the-box, so cabal-install
+may depend on newer versions of libraries if they can still be
+compiled by 3-year-old versions of GHC.