The test-system-libs job in .github/workflows/tests.yml pins LIBMONGOCRYPT_VERSION (e.g. "1.19") and installs libmongocrypt-dev via apt from the libmongocrypt apt repo.

Whenever a new upstream libmongocrypt release is published, apt-get install "libmongocrypt-dev=1.19*" fails because libmongocrypt-dev depends on the exact libmongocrypt0 version, and apt tries to install the newest available libmongocrypt0:

libmongocrypt-dev : Depends: libmongocrypt0 (= 1.19.2-0) but 1.20.0-0 is to be installed
E: Unable to correct problems, you have held broken packages.

This forces us to bump LIBMONGOCRYPT_VERSION in the workflow every time a new libmongocrypt is released, even when we do not intend to bump the bundled library.

This is also a problem for maintenance of older branches: once a new libmongocrypt is released, the pinned LIBMONGOCRYPT_VERSION on a maintenance branch stops installing, so we cannot land patches on that branch without bumping libmongocrypt, which is usually not desirable on a maintenance branch.

Example failing run (before PHPC-2729 updated the workflow):
https://github.com/mongodb/mongo-php-driver/actions/runs/28798768333/job/85396160151?pr=2034

We should either pin both packages consistently, use a version range that survives minor bumps, or find another install strategy so a new libmongocrypt release does not break CI on unrelated PRs.