[AWS::DMS::ReplicationInstance] - [Enhancement] - Propagate tags to service-managed ENIs / Network interfaces

### Name of the resource

AWS::DMS::ReplicationInstance

### Resource name

_No response_

### Description

When an AWS DMS replication instance is created, the service provisions ENIs in the account's VPC with the description `DMSNetworkInterface`. DMS always creates replication instances in a VPC. For Multi-AZ deployments, ENIs are created in multiple subnets. These service-managed ENIs do not inherit tags from the replication instance.

### Problem

- DMS creates ENIs with the description `DMSNetworkInterface` in the subnets of the replication subnet group.
- These ENIs carry no tags - no reference to the owning replication instance, replication subnet group, or migration task.
- ENIs can be replaced during Multi-AZ failovers, instance class modifications, or maintenance events.
- There is no mechanism -via CloudFormation or the DMS API- to control tags on these ENIs at creation time.

### Impact

Organizations enforcing mandatory tagging policies face:
- **Cost allocation gaps**: Untagged ENIs cannot be attributed to a project or team.
- **Compliance violations**: AWS Config rules like `required-tags` flag these ENIs as non-compliant.
- **Operational overhead**: Workarounds require event-driven Lambda functions to retroactively tag ENIs, with race conditions during failover or maintenance events when ENIs are replaced.
- **Identification difficulty**: Without tags, correlating ENIs to a specific replication instance requires cross-referencing private IP addresses via the DMS `describe-replication-instances` API.

### Expected Behavior

Tags defined on `AWS::DMS::ReplicationInstance` should be automatically propagated to all ENIs created by the DMS service. When ENIs are replaced during lifecycle events (failover, maintenance, instance modification), new ENIs should receive the current tags from the parent replication instance.

### Other Details

- DMS Serverless replications also create ENIs in the account's VPC with a similar pattern.
- The DMS service role requires `ec2:CreateNetworkInterface`, `ec2:DescribeNetworkInterfaces`, and `ec2:DeleteNetworkInterface` permissions.
- DMS ENIs are requester-managed and cannot be detached or deleted by the users while the replication instance exists.

### Reproduction

1. Create a DMS replication instance with tags via CloudFormation:
```yaml
MyReplicationInstance:
Type: AWS::DMS::ReplicationInstance
Properties:
ReplicationInstanceClass: dms.t3.medium
ReplicationSubnetGroupIdentifier: !Ref MyDMSSubnetGroup
VpcSecurityGroupIds:
- sg-xxx
Tags:
- Key: Environment
Value: production
- Key: CostCenter
Value: "12345"
```
2. List ENIs:
```
aws ec2 describe-network-interfaces \
--filters "Name=description,Values=DMSNetworkInterface" \
--query "NetworkInterfaces[].{ID:NetworkInterfaceId,Desc:Description,Tags:TagSet}"
```
3. Observe: `TagSet` is empty on the DMS-managed ENIs.

No repository file or test entry point is provided. Start by reproducing the behavior with the supplied CloudFormation template and AWS CLI query, then review AWS::DMS::ReplicationInstance tagging and ENI lifecycle behavior; done means current parent tags appear on service-managed ENIs, including replacements.

Written by the indexing model from the issue text.