[DEV-15009] Feat: add option to use nat-instances, disabled by default

[ltellesfl]

Note

Medium Risk
Moderate risk because it changes networking module version and introduces a new NAT egress mode (instances vs gateways) that can affect cluster outbound connectivity and routing when enabled.

Overview
Adds an opt-in path to use NAT instances instead of NAT gateways by upgrading the indico-aws-network module to 2.5.0 and wiring through new inputs (use_nat_instances, indico_nat_instance_type, indico_nat_enable_ssm).

Also updates tag propagation into the networking module by passing a merged additional_tags value (combining default_tags and additional_tags).

^{Written by Cursor Bugbot for commit e0ae632. This will update automatically on new commits. Configure here.}