[MONGOCRYPT-838] Upload build artifacts to a restricted bucket on release branch builds (#1126)

* Switch the upload target bucket based on the project/patch status

This change replaces all references to the mciuploads bucket in the CI
configuration file with a template expansion that conditionally refers to an
alternate bucket in certain scenarios. This templating also sets the role_arn
for S3 operations based on the same conditions.

* Restrict access to files posted in S3

* Python steps use the unrestricted bucket

* Use the same role to download files for the Python release script

* Use `libmongocrypt`, not `${project}`

Quoting DEVPROD-20712:
> please write all artifacts to "s3://cdn-origin-libmongocrypt/libmongocrypt/"

* Add skip_existing:true to s3.put

* Fix package url

---------

Co-authored-by: Kevin Albertson <kevin.albertson@mongodb.com>

Author: vector-of-bool