[MONGOCRYPT-838] Upload build artifacts to a restricted bucket on release branch builds

[vector-of-bool]

Let's try this again. Refer: MONGOCRYPT-838

Summary

This changeset does the following:

1. All S3 put operations now use permissions: private and visibility: signed.
2. On any build that isn't in libmongocrypt-release or any build that is a patch, artifacts are transmitted in the mciuploads bucket using a less-restricted role for that bucket.
3. On libmongocrypt-release commit or tag builds, artifacts are transmitted and posted in the cnd-origin-libmongocrypt bucket using a restricted role.

[vector-of-bool]

Need to be addressed: Some scripts still download (via HTTP) from the mciuploads buckets directly, specifically those related to the Python release. I think those can be updated separately as those tasks run on their own schedule and won't need updating until the next release.

[kevinAlbs]

Need to be addressed: Some scripts still download (via HTTP) from the mciuploads

I also expect the "publish packages" function also needs to update the URL. Possibly with an addition:

if "${project}" = 'libmongocrypt-release'; then
  package_url_prefix="https://downloads.mongodb.org"
else
  package_url_prefix="https://mciuploads.s3.amazonaws.com"
fi

That runs on every mainline commit. So I expect that would need to be updated before cherry-picking to avoid failures in the publish-packages tasks.

[kevinAlbs]

LGTM with a comment removal.

[kevinAlbs]

To test before merging, I temporarily set the libmongocrypt-release Evergreen project to test a branch (MONGOCRYPT-838) with that PR to test the upload to the restricted bucket. With the added commits, the new upload appears to work.