We release from the latest master on libmongocrypt.  While this is convenient for libmongocrypt bug fixes, this means that we never pin to a version of libmongocrypt and potentially release mongodb-client-encryption with in-progress changes.  We should instead release from a git tag and pin to particular versions of libmongocrypt.

While we're making this change, we should consider making our prebuild process explicit.  Currently, the prebuild script runs with every node tasks and makes itself a no-op when there are no changes to release.  It also has hard-coded logic to determine the architecture of the current system and conditionally run prebuild.

We could instead pipe an environment variable down from the config to control which build variants we want to release from.  This makes our build matrix explicit and easy to control, and removes the potential for multiple build variants to release the same package (our logic currently allows this for tasks run on the same evergreen distro).