aws_ec2: random AZ assignment is always the same?

### Describe the bug

When I read [the documentation on Python aws_ec2.instance](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/Instance.html) it says:
> availability_zone (Optional[str]) – In which AZ to place the instance within the VPC. Default: - Random zone.

I am creating a VPC with 3 public subnets, 3 NAT gateways, and 3 private subnets wired up with routes to the 3 NAT gateways. But the EC2 instances deployed to that VPC are always assigned to the 'a' Availability Zone.

### Expected Behavior

When I run `cdk synth` and inspect the resulting json template, I always see the following:
`"AvailabilityZone": "us-east-2a"`

If the AZ selected is actually random, I expect it to see "us-east-2a" sometimes, "us-east-2b" sometimes, and "us-east-2c" sometimes.

### Current Behavior

Every CloudFormation output for every instance always selects the first availability zone. Do I misunderstand what "Random Zone" means?

### Reproduction Steps

This app will reproduce what I am seeing.

1. Run `cdk synth` on this app
2. Run `grep Availability cdk.out/basisi*json`
3. Observe that it's all `"AvailabilityZone": "us-east-2a",`

```
import os
import aws_cdk as cdk
import aws_cdk.aws_ec2 as ec2
import aws_cdk.aws_iam as iam
from constructs import Construct

class VpnInstancesStack(cdk.Stack):

def __init__(self, vpcStack: Construct, construct_id:
str, thing: str, env: cdk.Environment, **kwargs) -> None:
super().__init__(vpcStack, construct_id, env=env, **kwargs)

thisVpc = vpcStack.vpc
ec2instance = ec2.Instance(self, f"i-{thing}",
vpc=vpcStack.vpc,
instance_type=ec2.InstanceType("m5.large"),
machine_image=ec2.AmazonLinuxImage(),
block_devices=[ec2.BlockDevice(
device_name="/dev/sda1",
volume=ec2.BlockDeviceVolume.ebs(50),
)
],
security_group = vpcStack.vpnSG,
)

class VpcBasisStack(cdk.Stack):

def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)

self.vpc = ec2.Vpc(self, 'out-vpc',
cidr = "172.17.0.0/18",
max_azs = 3,
subnet_configuration=[
ec2.SubnetConfiguration(
name = 'pub',
subnet_type = ec2.SubnetType.PUBLIC,
cidr_mask = 26
),
ec2.SubnetConfiguration(
name = 'pri',
subnet_type = ec2.SubnetType.PRIVATE_WITH_NAT,
cidr_mask = 20
)
],
nat_gateways = 3
)

# Create standard Security Group for all EC2 instances
self.vpnSG = ec2.SecurityGroup(self, 'vpn-sg', vpc=self.vpc,
allow_all_outbound=True, security_group_name='vpn-sg' );

app = cdk.App()
cdkEnv = cdk.Environment(account=os.getenv('CDK_DEFAULT_ACCOUNT'),
region="us-east-2")

vpcStack = VpcBasisStack(app, "basis", env=cdkEnv )

deployList = [ "a", "b", "c" ]

for thing in deployList:
VpnInstancesStack(vpcStack, f"i-{thing}-s", thing=thing, env=cdkEnv )

app.synth()
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.43.0 (build 487870a)

### Framework Version

_No response_

### Node.js Version

v14.18.3

### OS

macOS

### Language

Python

### Language Version

Python 3.9.14

### Other information

Looking at the code, I suspect the line we're talking about is [this line in instance.ts](https://github.com/aws/aws-cdk/blob/cb1506f090e36a6da78b8a8a1edf9a1256478311/packages/%40aws-cdk/aws-ec2/lib/instance.ts#L366). If I were to think this through, I don't see how we can both be "random" and be deterministic.

Start at packages/@aws-cdk/aws-ec2/lib/instance.ts around the linked line and reproduce the behavior with the supplied Python app. Run cdk synth and inspect the generated AvailabilityZone values in cdk.out; done means the documented random-zone behavior and synthesized template behavior are reconciled or the documentation is clarified.

Written by the indexing model from the issue text.