fix(ec2): allow NAT instance to associate public IP

[GavinZZ]

Issue # (if applicable)

Closes #31711

Reason for this change

When we set mapPublicIpOnLaunch=false for public subnets, NAT instances does not get public IP addresses assigned, resulting in non-working NAT instances.

Disabling mapPublicIpOnLaunch is recommended as AWS Config rule (and cdk-nag as well.) https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html

Description of changes

Support associatePublicIpAddress

Description of how you validated changes

New unit and integ tests.

Checklist

• [ ] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license