aws-ec2: cannot synth Vpc with CIDR mask configuration

### Describe the bug

I cannot synth the following code:
```js
const ec2 = require("aws-cdk-lib/aws-ec2");
const vpc = new ec2.Vpc(this, "my-vpc", {
vpcName: "my-vpc",
ipAddresses: ec2.IpAddresses.cidr("10.199.32.0/20"),
natGateways: 1,
subnetConfiguration: [
{
name: "public-subnet",
subnetType: ec2.SubnetType.PUBLIC,
cidrMask: 25
},
{
name: `private-with-nat-subnet`,
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
cidrMask: 22
},
{
name: `private-isolated-subnet`,
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
cidrMask: 25
}
]
});
```

Instead, I get the error `1 of /25 exceeds remaining space of 10.199.32.0/20`.

### Expected Behavior

I understand that the default config results in 3 AZs, meaning this configuration would have a total of 9 subnets.

As far as I'm aware, the above configuration should be able to produce a subnet layout similar to the following that fits within the given CIDR:
```
10.199.32.0/22 Private with NAT
10.199.36.0/22 Private with NAT
10.199.40.0/22 Private with NAT
10.199.44.0/25 Public
10.199.44.128/25 Public
10.199.45.0/25 Public
10.199.45.128/25 Private Isolated
10.199.46.0/25 Private Isolated
10.199.46.128/25 Private Isolated
```

### Current Behavior

Instead of the synth succeeding, I get the error `1 of /25 exceeds remaining space of 10.199.32.0/20`.

### Reproduction Steps

Attempt to synth the example code.

### Possible Solution

Perhaps there is a hidden network feature that is restricting the IP space available to me, otherwise I think I've miscalculated my subnets or this is a bug.

### Additional Information/Context

_No response_

### CDK CLI Version

2.81.0

### Framework Version

_No response_

### Node.js Version

20.2.0

### OS

Arch Linux 6.3.4

### Language

Typescript

### Language Version

JavaScript

### Other information

If I reduce the `PRIVATE_WITH_EGRESS` CIDR mask to /23, I can successfully synth the project but this provides me with considerably fewer IPs.

Reproduce the example through ec2.Vpc with IpAddresses.cidr and the shown subnetConfiguration. Start at the Vpc subnet allocation path and inspect how the /22 and /25 masks are assigned across the default three Availability Zones. Done means the example synthesizes successfully while preserving the requested subnet masks and fitting within 10.199.32.0/20.

Written by the indexing model from the issue text.