DRIVERS-2924 test accessToken form of KMS providers

[kevinAlbs]

Summary

Test accessToken form of KMS providers

Background & Motivation

See DRIVERS-2924. The Azure and GCP KMS providers support specifying an accessToken within libmongocrypt. Though the accessToken form is specified, there were no specification tests prior to this PR.

Schema 1.28 is a copy of 1.27 with the accessToken form of KMS providers added. The copy and addition are on separate commits to ease review. Caveat: schema 1.28 is only added to support accessToken. I briefly considered prose tests, but I expect that is more manual changes for driver teams. Updating the unified test runner to support the accessToken field was a small effort in the C driver.

DOCSP-58569 was filed to document the accessToken form of KMS providers in the mongodb.com docs.

Running tests

The new spec tests include KMS provider configuration using the $$placeholder value:

azure: { accessToken: { $$placeholder: 1 } }
gcp: { accessToken: { $$placeholder: 1 } }

mongodb-labs/drivers-evergreen-tools#751 generates access tokens to test. Spec tests were tested in the C driver: mongodb/mongo-c-driver#2253

---

Please complete the following before merging:

• Is the relevant DRIVERS ticket in the PR title?
• Update changelog.
• Test changes in at least one language driver. (CDRIVER-6270 test and document accessToken KMS providers mongo-c-driver#2253)
• Test these changes against all server versions and topologies (including standalone, replica set, and sharded
  clusters). (CDRIVER-6270 test and document accessToken KMS providers mongo-c-driver#2253)

[alcaeus]

Changes themselves LGTM. You should add schema tests (see the tests/valid and tests/invalid directories) to ensure correct behaviour of anyOf and allOf.

[kevinAlbs]

add schema tests (see the tests/valid and tests/invalid directories) to ensure correct behaviour of anyOf and allOf.

AFAICT I cannot specifically test the change of anyOf to oneOf in this case. I.e. anyOf[A,B] where A and B are mutually exclusive, would match the same as oneOf[A,B]. The use of oneOf is intended to better convey the intent (matches exactly one condition).

However, I added invalid tests to add negative-test coverage over the new accessToken form.

[rozza]

LGTM