mike/feat-TELEMTRAF-7944: add arm-supporting AZ VPC export

[michael-mbox]

Adds a new DefaultVpc output property: FargateArm64PrivateSubnets.

This output is an array of private subnet IDs from the default VPC, excluding physical availability zones where AWS Fargate ARM64 is not supported. Today the known unsupported case is use1-az3 in us-east-1, per AWS ECS ARM64 documentation.

This does not change any existing DefaultVpc outputs such as PrivateSubnets, PublicSubnets, AzIndexedPrivateSubnets, or AzIndexedPublicSubnets. Existing stacks will continue to receive the same attributes they use today; this PR only adds a new attribute for stacks that explicitly opt into it.

Why

live-traffic-engine is migrating Fargate tasks to ARM64 for cost savings. Its legacy CloudFormation/cloudfriend service stack currently uses the shared vpc-private-subnets export, which includes subnet-276c8319 (us-east-1c / physical AZ use1-az3). Fargate ARM64 does not support use1-az3, so ARM64 task placement needs a private subnet set that excludes that AZ while preserving multi-AZ placement.

CDK consumers can filter subnets by AZ, but cloudfriend/raw CFN stacks need either hardcoded subnet IDs or a custom-resource/exported value. This adds a reusable custom-resource attribute so LTE and similar legacy CFN stacks can avoid hardcoding subnet IDs.

Usage example

A CloudFormation/cloudfriend stack can define the existing custom resource:

DefaultVpc: {
  Type: 'Custom::DefaultVpcLookup',
  Properties: {
    ServiceToken: cf.importValue('default-vpc-lookup'),
  },
},

Then use the new attribute for Fargate ARM64 subnet placement:

NetworkConfiguration: {
  AwsvpcConfiguration: {
    AssignPublicIp: 'DISABLED',
    SecurityGroups: [/* ... */],
    Subnets: cf.getAtt('DefaultVpc', 'FargateArm64PrivateSubnets'),
  },
},

For LTE in us-east-1, this should resolve to the ARM-safe private subnet set equivalent to A/D/E, excluding the private subnet in use1-az3.

Testing

• Updated test/default-vpc.test.js to verify FargateArm64PrivateSubnets excludes a private subnet with AvailabilityZoneId: use1-az3 while preserving existing DefaultVpc outputs.
• Local test suite passes: 158 passing.