docs: mention maintenance branches
    
    Mitre tried to assign us two separate CVEs for the fix for
    https://bugzilla.redhat.com/show_bug.cgi?id=1047577, on the
    grounds that the fixes were separated by more than an hour
    and thus triggered different hourly snapshots.  But we
    explicitly do NOT want to treat transient security bugs as
    CVEs if they can only be triggered by patches in libvirt.git
    but where the problem is cleaned up before a formal release.
    
    Meanwhile, I noticed that while our wiki mentioned maintenance
    branches and releases, our formal documentation did not.
    
    * docs/downloads.html.in: Contrast hourly snapshots with
    maintenance branches.
    
    Signed-off-by: Eric Blake <eblake@redhat.com>