[AWS::Lambda::Function] - [Enhancement] - Lambda with enabled VPC: Propagate tags to VPC-attached ENIs / Network interfaces

### Name of the resource

AWS::Lambda::Function

### Resource name

_No response_

### Description

When a Lambda function is configured with VPC access (via `VpcConfig` specifying `SubnetIds` and `SecurityGroupIds`), the Lambda service creates Hyperplane ENIs in the specified subnets. These are a special type of requester-managed ENI that connect the Lambda service VPC to the account's VPC. These ENIs do not inherit tags from the Lambda function.

### Problem

- Hyperplane ENIs are created automatically when a function is first attached to a VPC. They are shared across all functions using the same subnet and security group combination.
- ENIs are managed entirely by the Lambda service: they can be recreated during health checks, load balancing, or after 14 days of function inactivity.
- The ENIs carry no tags - not even a reference to the owning function(s) or the Lambda service.

### Impact

Organizations enforcing mandatory tagging policies face:
- **Compliance violations**: AWS Config rules flag these ENIs as non-compliant.
- **Cost allocation gaps**: ENIs cannot be attributed to a cost center or team.
- **Operational overhead**: Retroactive tagging via EventBridge + Lambda is unreliable because Hyperplane ENIs are shared across functions and can be replaced at any time by the Lambda service.

### Expected Behavior

Tags defined on `AWS::Lambda::Function` should be propagated to the Hyperplane ENIs created for VPC access. Since ENIs are shared across functions with the same subnet/security group combination, a reasonable approach would be to apply a common set of tags (e.g., `aws:lambda:vpc-enabled`, or tags from the first function that triggered ENI creation).

### Other Details

- Hyperplane ENIs are requester-managed (`requester-managed: true`) and owned by the Lambda service.
- The execution role requires `ec2:CreateNetworkInterface`, `ec2:DescribeNetworkInterfaces`, `ec2:DeleteNetworkInterface`, `ec2:AssignPrivateIpAddresses`, and `ec2:UnassignPrivateIpAddresses` (provided by the managed policy `AWSLambdaVPCAccessExecutionRole`).
- Each Hyperplane ENI supports up to 65,000 connections. Lambda scales ENIs automatically based on traffic and concurrency.

### Reproduction

1. Create a VPC-attached Lambda function with tags via CloudFormation:
```yaml
MyFunction:
Type: AWS::Lambda::Function
Properties:
FunctionName: my-vpc-function
Runtime: python3.12
Handler: index.handler
Role: !GetAtt LambdaRole.Arn
Code:
ZipFile: |
def handler(event, context):
return "ok"
VpcConfig:
SubnetIds:
- subnet-aaa
- subnet-bbb
SecurityGroupIds:
- sg-xxx
Tags:
- Key: Environment
Value: production
```
2. Invoke the function to trigger ENI creation, then list ENIs:
```
aws ec2 describe-network-interfaces \
--filters "Name=description,Values=AWS Lambda VPC ENI*" \
--query "NetworkInterfaces[].{ID:NetworkInterfaceId,Desc:Description,Tags:TagSet}"
```
3. Observe: `TagSet` is empty.

No repository file or test is named. Start by checking whether AWS Lambda supports tagging shared Hyperplane ENIs and whether CloudFormation controls that behavior, then validate with the supplied CloudFormation example and aws ec2 describe-network-interfaces command. Done means a confirmed feasible coverage change with defined tag behavior for shared ENIs.

Written by the indexing model from the issue text.