There are two different ways to exclude tests from evergreen suites - tagging with a label, and explicitly setting an exclude in the suite definition. The latter seems to be used quite a bit, but also is less correct because we lose information as to why the test has been excluded. Comments go stale, so the correct way to do this should always be to use tags, since this binds information as to why the test is excluded.

We should audit server security’s uses of excludes and try to adopt tags as the proper way of excluding tests from suites and variants.

This ticket will probably be split into sub tickets, when we decide how to properly split up this work (either by test suite or by test directory).