Subnet information is only really needed when the specified `vpc_id` is
not the default VPC for the region where the builder is being executed.
This change uses the AWS API to determine if the VPC provided is a
non-default VPC and only validates the existence of a `subnet_id` if a
user has provided a non-default `vpc_id`.
Tests after change
```
> make test TEST=./builder/amazon/... TESTARGS='-count=1 -v -run=TestStepPreValidate_checkVpc'
...
=== RUN TestStepPreValidate_checkVpc
=== RUN TestStepPreValidate_checkVpc/DefaultVpc
=== RUN TestStepPreValidate_checkVpc/NonDefaultVpcNoSubnet
=== RUN TestStepPreValidate_checkVpc/NonDefaultVpcWithSubnet
=== RUN TestStepPreValidate_checkVpc/SubnetWithNoVpc
=== RUN TestStepPreValidate_checkVpc/NoVpcInformation
--- PASS: TestStepPreValidate_checkVpc (0.00s)
--- PASS: TestStepPreValidate_checkVpc/DefaultVpc (0.00s)
--- PASS: TestStepPreValidate_checkVpc/NonDefaultVpcNoSubnet (0.00s)
--- PASS: TestStepPreValidate_checkVpc/NonDefaultVpcWithSubnet (0.00s)
--- PASS: TestStepPreValidate_checkVpc/SubnetWithNoVpc (0.00s)
--- PASS: TestStepPreValidate_checkVpc/NoVpcInformation (0.00s)
PASS
...
```
We can't tag on instance creation when we're in "restricted" regions,
so let's add the tags after the resources have been created.
Adds methods to AccessConfig to detect if we're in China or US Gov
regions (i.e. "restricted").
Also turns tag:tag maps into a type, and moves methods around validating
and converting them to ec2Tags to methods of the type.