[AWS::EC2::VPCEndpoint] - [Enhancement] - Propagate tags to service-managed ENIs / Network interfaces

### Name of the resource

AWS::EC2::VPCEndpoint

### Resource name

_No response_

### Description

VPC Endpoints (`VpcEndpointType: Interface`) create ENIs in the specified subnets. These ENIs do not receive the tags defined on the `AWS::EC2::VPCEndpoint` resource. While tags can be added manually via the EC2 API (`CreateTags`), there is no mechanism to automatically propagate tags from the VPC Endpoint to its ENIs at creation time or when ENIs are replaced.

The `Tags` property on the VPC Endpoint resource only applies to the endpoint itself. The ENIs stay untagged.

### Problem

* ENI descriptions look like `VPC Endpoint Interface vpce-`, but they carry no tags.
* No `TagSpecifications` mechanism exists for these ENIs (unlike EC2 Launch Templates).
* There is no easy/quick reference from the ENI back to the owning VPC Endpoint via tags.

### Impact

* Cost allocation on ENI level (e.g. data transfer) is impossible. Untagged ENIs cannot be attributed to a team or project.
* AWS Config rules like `required-tags` flag these ENIs as non-compliant, even though they are fully service-managed.
* Workarounds (Lambda via CloudTrail + EventBridge to retroactively tag) are fragile and create race conditions when ENIs get replaced by the service.
* At scale (many VPC Endpoints across multiple accounts), this results in hundreds of untagged ENIs that cannot be identified without custom tooling.

### Expected Behavior

Tags from `AWS::EC2::VPCEndpoint` should be propagated to the ENIs created by the service. When ENIs are replaced, the new ones should also receive the current tags.

### Other Details

#### Reproduction

1. Create an Interface VPC Endpoint via CloudFormation with tags:

```yaml
MyVPCEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
ServiceName: com.amazonaws.eu-central-1.ssm
VpcId: !Ref VPC
VpcEndpointType: Interface
SubnetIds:
- !Ref SubnetA
- !Ref SubnetB
Tags:
- Key: Environment
Value: production
- Key: CostCenter
Value: 12345
```

2. After deployment, check the ENIs:

```bash
aws ec2 describe-network-interfaces \
--filters "Name=description,Values=VPC Endpoint Interface*" \
--query "NetworkInterfaces[].{ID:NetworkInterfaceId,Desc:Description,Tags:TagSet}"
```

3. Result: `TagSet` is empty on all VPC Endpoint ENIs.

#### Note

This is distinct from #1254 (which requests the ability to *specify* ENIs when creating a VPC Endpoint). This issue is about tagging the automatically created ENIs.

Start with the AWS::EC2::VPCEndpoint resource behavior described in the issue and reproduce it using the provided CloudFormation YAML and aws ec2 describe-network-interfaces command. Done means tags from an Interface VPC Endpoint appear on its service-managed ENIs at creation and remain current when those ENIs are replaced.

Written by the indexing model from the issue text.