[AWS::RDS::DBInstance] - [Enhancement] - Propagate tags to service-managed ENIs / Network interfaces

### Name of the resource

AWS::RDS::DBInstance

### Resource name

_No response_

### Description

When an RDS DB instance (`AWS::RDS::DBInstance`) is created in a VPC, the RDS service provisions ENIs in the subnets of the associated DB subnet group. These requester-managed ENIs provide network connectivity for the DB instance. They do not inherit tags from the DB instance or the DB subnet group.

### Problem

- RDS creates ENIs with the description `RDSNetworkInterface` in the subnets of the DB subnet group.
- These ENIs carry no tags - no reference to the owning DB instance, DB cluster, or subnet group.
- ENIs are managed by the RDS service and can be replaced during failovers, Multi-AZ switchovers, scaling events, or maintenance windows.
- There is no mechanism -via CloudFormation or the RDS API- to control tags on these ENIs at creation time.

### Impact

Organizations enforcing mandatory tagging policies face:
- **Cost allocation gaps**: Untagged ENIs cannot be attributed to a project or team.
- **Compliance violations**: AWS Config rules like `required-tags` flag these ENIs as non-compliant.
- **Operational overhead**: Workarounds require event-driven Lambda functions to retroactively tag ENIs, with race conditions during failover or maintenance events when ENIs are replaced.

### Expected Behavior

Tags defined on `AWS::RDS::DBInstance` should be automatically propagated to all ENIs created by the RDS service. When ENIs are replaced during lifecycle events (failover, maintenance), new ENIs should receive the current tags from the parent DB instance.

### Other Details

- The same issue applies to `AWS::RDS::DBCluster` (Aurora) and `AWS::RDS::DBProxy`, which also create service-managed ENIs.
- RDS ENIs are requester-managed and cannot be detached or deleted by the customer while the DB instance exists.

### Reproduction

1. Create an RDS instance with tags via CloudFormation:
```yaml
MyDB:
Type: AWS::RDS::DBInstance
Properties:
DBInstanceClass: db.t3.micro
Engine: mysql
MasterUsername: admin
MasterUserPassword: !Ref DBPassword
DBSubnetGroupName: !Ref MySubnetGroup
Tags:
- Key: Environment
Value: production
- Key: CostCenter
Value: "12345"
```
2. List ENIs:
```
aws ec2 describe-network-interfaces \
--filters "Name=description,Values=RDSNetworkInterface" \
--query "NetworkInterfaces[].{ID:NetworkInterfaceId,Desc:Description,Tags:TagSet}"
```
3. Observe: `TagSet` is empty on the RDS-managed ENIs.

Start by reproducing the behavior with the provided AWS::RDS::DBInstance template and the aws ec2 describe-network-interfaces command. Confirm whether tags can propagate to RDS-managed ENIs, including replacements during failover or maintenance; done means the requested behavior is supported for the listed RDS resources.

Written by the indexing model from the issue text.