Consistently configure SSL/TLS per task instead of per variant

Right now, we are inconsistent re: how we decide whether a particular integration test task runs with SSL/TLS on or off. We have some variables that are configured at the buildvariant level, and others that are configured at the task level. Occasionally, these can conflict, leading to build failures like TOOLS-2693.

It would be more consistent if we removed all TLS-related configuration from the buildvariants themselves, and instead configured TLS on a task-by-task basis, like we are already doing for auth.