fix(ec2): wrap L1 CfnSubnet in selectSubnetObjects so SubnetIds resolve in templates

[Zelys-DFKH]

Closes #37144

Exemption Request: This fix changes internal behavior of VpcBase.selectSubnetObjects(). No new CloudFormation resource types, properties, or cross-service integrations. Per AGENTS.md, integration tests are required for "new CFN resource types, new CFN properties, cross-service integrations, new versions, Custom Resources". This fix is none of those. Two unit tests with Template.fromStack assertions cover the regression and the singleton guard. An integration test file is included (integ.vpc-endpoint-cfn-subnet.ts) but generating the .js.snapshot requires running integ-runner, which needs a full local build of aws-cdk-lib. I can generate it if a reviewer can point me to a way to run the runner or confirm the expected template output.

---

Credit to @pahud, whose diagnosis in the issue thread got the root cause and fix direction right. And to @Aaxhirrr, who implemented the same approach in #37179. This PR picks up where that one left off with a couple of additions.

---

Why this breaks

When CfnSubnet (L1) objects are passed via SubnetSelection.subnets, the synthesized template produces empty SubnetIds. VpcBase.selectSubnetObjects() returns the array unchanged, and downstream code calls .subnetId on each entry, a property from the ISubnet interface that CfnSubnet doesn't have. CDK drops the undefined entries without any warning.

What changed

selectSubnetObjects() now uses CfnSubnet.isCfnSubnet() to identify L1 objects and wraps them via Subnet.fromSubnetAttributes(), producing a real ISubnet backed by the L1's { Ref } token. The wrapper construct ID is keyed on Node.of(subnet).addr (a unique hash of the full construct path) so repeated calls to selectSubnets() with the same CfnSubnet reuse the existing wrapper instead of creating duplicates.

SubnetSelection.subnets JSDoc is updated to document that CfnSubnet objects are accepted and auto-wrapped.

Tests

Two regression tests in vpc-endpoint.test.ts:

1. CfnSubnet passed to addInterfaceEndpoint: asserts SubnetIds: [{ Ref: "<logicalId>" }]. Fails on unfixed code, passes on the fix.
2. Same CfnSubnet passed to two endpoints: confirms the singleton guard doesn't throw a duplicate-construct error on repeated calls.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[Zelys-DFKH]

CI is red because the integration test added here is missing part of its snapshot directory. The error is ENOENT on test/aws-ec2/test/integ.vpc-endpoint-cfn-subnet.js.snapshot/aws-cdk-ec2-vpc-endpoint-cfn-subnet.metadata.json, and neither stack in that snapshot has a .metadata.json file.

I have not run cdk-integ with --dry-run or written the snapshot by hand, since CONTRIBUTING asks contributors not to. Could a maintainer run the integration test so it gets generated from a real deployment?