overriding subnet ids with the modify command doesn't disassociate the current ones first

```sh
cfn-vpn modify name --subnet-ids subnet-123 subnet-456
```

produces error

```
Duplicate subnet detected in az ap-southeast-2a (Service: AmazonEC2; Status Code: 400; Error Code: InvalidClientVpnSubnetId.DuplicateAz; Request ID: ***; Proxy: null)
```

Start with the implementation of the `cfn-vpn modify` command and trace how the supplied subnet IDs are applied to the existing Client VPN endpoint. Reproduce the command using the example IDs and verify that replacing subnets no longer produces the `DuplicateAz` error.

Written by the indexing model from the issue text.