AWS::EC2::VPC - CreateDefaultNetworkACL / -- It should be possible to create VPC with an empty default networkACL

### Name of the resource

AWS::EC2::VPC

### Resource name

_No response_

### Description

Not possible in cloudformation to remove rules from default NetworkACL created by VPC.

Hard to comply with
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls-1.4.0.html
5.1 – Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html
[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html

So an option in VPC
NetworkACLNoRules: True
or similar.

Related to https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/658 , also makes it hard to setup security compliant stacks using cloudformation.

### Other Details

_No response_

Start with the AWS::EC2::VPC resource documentation and the related coverage-roadmap issue 658. Review how default NetworkACL rules are currently handled and define what behavior an option such as NetworkACLNoRules should provide. Done means CloudFormation can create a VPC whose default network ACL has no rules and the requested security controls can be met.

Written by the indexing model from the issue text.