update the minimum version policy

[keewis]

As suggested in #4179, this updates the policy to "the most recent minor version (X.Y) initially published more than N months ago" or, slightly less correct but (for me) easier to understand: "the most recent minor version (X.Y) available N months ago".

This also reduces the policy months for python to 24 months and for numpy to 18 months.

• Closes Consider revising our minimum dependency version policy #4179
• Passes pre-commit run --all-files
• User visible changes (including notable bug fixes) are documented in whats-new.rst

[keewis]

this should be ready for review / merging. There are also a few packages we are able to bump (most notably, numpy to 1.17 and pandas to 1.0).

[max-sixty]

LGTM!