For an aggregation like

coll.aggregate({$lookup: {from: "coll", as: "docs", pipeline: [{$match: {encryptedField: "1"}}])}}

We do not mark the constant "1" for encryption in query analysis. But, we allow self-lookups with encrypted collections, so this kind of query should be supported.

Once this is supported in query analysis, the server-side rewrites should be updated to support rewrites of subpipelines.