MONGOCRYPT-837 sign libmongocrypt-all.tar.gz

[kevinAlbs]

Summary

Add sign-all task to sign libmongocrypt-all.tar.gz.

Background & Motivation

See MONGOCRYPT-837 for motivation. I would like to eventually remove libmongocrypt-all.tar.gz. But providing a signature seemed like a low-effort way to address this concern in the short-term.

Tested in an Evergreen patch including the upload-all task listing libmongocrypt-all.tar.gz and a new sign-all task listing libmongocrypt-all.asc.

To verify the signature:

curl https://pgp.mongodb.com/libmongocrypt.asc | gpg --import
gpg --verify libmongocrypt-all.asc libmongocrypt-all.tar.gz

---

Signing credentials are stored in the Evergreen repo settings as "Admin Only". I think "Admin Only" was requested by the Server Security team to limit exposure, but I did not find a reference.

The new sign-all task is marked with patchable: false. Quoting Evergreen docs:

Patches and PRs activated by non-admin users will not have access to these variables.

To test in a patch, I temporarily unselected "Admin Only".

---

The Publish variant is migrated to use ubuntu2404-latest. This was motivated by an observed error on docker login:

Error saving credentials: open /home/ubuntu/.docker/config.json2722102583: permission denied