[AWS::EC2::VPNConnection] - [Enhancement] - Modifying settings within `VpnTunnelOptionsSpecification` such as `LogOptions` or `DPDTimeoutAction` should be possible with replacement

### Name of the resource

AWS::EC2::VPNConnection

### Resource name

AWS::EC2::VPNConnection VpnTunnelOptionsSpecification

### Description

A user can go into the AWS Console, pick out any Site-to-Site VPN connection and make changes to the tunnels without having the entire VPN connection re-created. This is absolutely vital when manipulating a VPN connection for troubleshooting, enabling logging or making changes to accommodate changes for the Customer Gateway that is creating the connection.

For now, I can not enable logging for all of my VPN connections using CloudFormation, as it would replace the connection, and I would need to engage with each of my customers to update the tunnel address and PSK that they are connecting to.

Going through each VPN Connection one-by-one and manually enabling CloudWatch logging on each is a cumbersome process, that should be automated through CloudFormation.

### Other Details

_No response_

Start by reviewing the AWS::EC2::VPNConnection coverage for VpnTunnelOptionsSpecification and the documented replacement behavior. Confirm the expected in-place update behavior for LogOptions and DPDTimeoutAction, then define the coverage change needed so tunnel settings can be modified without recreating the VPN connection.

Written by the indexing model from the issue text.