PYTHON-5991 - [pymongocrypt] Bundle libmongocrypt 1.20.2

[blink1073]

Summary

Bundles libmongocrypt 1.20.2 and renames the text_opts parameter to string_opts. The rename is breaking, so this becomes release 1.19.0 rather than a patch.

Motivation

PYTHON-5991 asks for bundled libmongocrypt at 1.20.2 or greater. The wheel build reads the version from scripts/libmongocrypt-version.txt, so that file determines which libmongocrypt a released wheel links against. 1.20.1 and 1.20.2 add validation of GCP KMS request fields.

The rename follows an instruction in the libmongocrypt header: driver public APIs should use the name "string" rather than "text" for these options. The parameter configures the algorithm now called "string", so text_opts no longer matches anything a caller sees.

Worth knowing for review: the C sources on this branch already contain everything through the 1.20.2 tag, since HEAD descends from it and git diff 1.20.0 1.20.2 -- src/mongocrypt.h is empty. There is no new C API to expose, so binding.py is deliberately untouched.

Changes

• Bundle libmongocrypt 1.20.2 in release wheels, and regenerate the SBOM
• Rename the text_opts parameter to string_opts on explicit encryption
• Bump the package version to 1.19.0.dev0, matching the changelog heading
• Cover the deprecated spellings that libmongocrypt still accepts or rejects, so a future libmongocrypt bump cannot change either behavior silently
• Correct the changelog, which claimed the "prefixPreview", "suffixPreview", and "substringPreview" query types had been replaced. They remain accepted as aliases
• Point the SBOM freshness check at scripts/update-version.sh, replacing a reference to a script that does not exist

Testing

Built libmongocrypt locally on macOS (Debug, CommonCrypto) and ran the Python suite against it:

python -m pytest test/ --ignore=test/performance
58 passed, 2 skipped, 6 subtests passed

Both new tests were checked against a deliberately broken variant to confirm they are not vacuous. Changing textPreview to string makes the first fail, and pointing the alias test at a nonexistent *Bogus query type makes the second fail.

The two new tests pin behavior that is easy to change by accident:

• the "textPreview" algorithm raises, matching the error libmongocrypt returns
• "prefixPreview", "suffixPreview", and "substringPreview" each produce a payload byte-identical to "prefix", "suffix", and "substring". PYTHON-5959 drops these aliases, and this test is what will fail when that happens

The SBOM freshness check from .evergreen/test.sh passes against the regenerated file. Pre-commit passes, including synchro, shellcheck, ruff, and ruff-format.

Breaking changes

text_opts is renamed to string_opts on ExplicitEncryptOpts and ExplicitEncrypter.encrypt, with no alias kept for the old name. Callers passing it as a keyword argument will raise TypeError; callers passing it positionally are unaffected.

The parameter has shipped since 1.16, so this is a visible API change. It only ever configured the algorithm that 1.16 documented as "experimental only" and "not intended for public use", which is why the rename is clean rather than deprecated in place. Say so if you would rather accept both names for a release.