EC2/VPC: Configure order of subnet creation

### Describe the feature

Related to https://github.com/aws/aws-cdk/issues/5927 - but this is a smaller request to make the existing Vpc L2 construct more flexible and work in more situations.

The existing Vpc construct does not support adding AZs to a VPC without breaking, but it comes close. The SubnetConfiguration allows for a stable cidrMask to be specified, so that adding subnets doesn't impact the CIDRs of existing subnets. The below talks about the case when cidrMask is specified, because when it isn't adding new subnets without changing existing ones will never work.

The existing code loops on subnet cofiguration first then on AZ when creating subnets. For each configuration it adds subnets for each AZ.
https://github.com/aws/aws-cdk/blob/9295a85a8fb893d7f5eae06108b68df864096c4c/packages/aws-cdk-lib/aws-ec2/lib/vpc.ts#L1748
This means that when adding a new subnet configuration to an existing VPC, the new subnets are added at the end and therefore the update can be performed without changing all existing subnets.
When adding an AZ however, subnets from the new AZ come before subnets from existing AZs and this throws off the CIDR allocations.

This could be addressed without breaking existing customers by adding a configuration parameter to the existing Vpc to specify whether to allocate subnets by configuration first or by AZ first. The default should be to allocate by configuration first so that it's backwards compatible, and users who want to keep the same configuration but add AZs will be able to change the option.

This would allow me to specify a Vpc like this and add AZs without replacing any existing subnets.

```
var v = new Vpc(this, "MyVpc", {
NEW_PARAM: byAz // the new param
subnetConfiguration: [
{
cidrMask: 22,
subnetType: SubnetType.PUBLIC,
name: "Public"
},
{
cidrMask: 22,
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
name: "Private"
},
],
availabilityZones: this.availabilityZones.slice(0, N) // here N can be increased to add AZs
})
```

### Use Case

I have an existing VPC and I want to add AZs. I can't do this today because it will require replacement of all subnets, and this will fail even if it could be tolerated because the new subnets will have CIDRs that clash with existing ones.

### Proposed Solution

Described above.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.x

### Environment details (OS name and version, etc.)

any

Start in packages/aws-cdk-lib/aws-ec2/lib/vpc.ts at the subnet creation loop around line 1748, and trace how SubnetConfiguration and availabilityZones determine allocation order. Define the option's default and by-AZ behavior, then verify that adding AZs preserves existing subnet CIDRs while the current configuration-first behavior remains compatible.

Written by the indexing model from the issue text.