docs(ec2): explain subnet AZ filtering with unresolved tokens

[caglarkc]

Issue # (if applicable)

Closes #27540.

Reason for this change

SubnetSelection.availabilityZones filters during synthesis. Literal AZ names cannot match subnet AZs represented by unresolved tokens, even when a VPC construct is passed between stacks.

Description of changes

Document the synthesis-time limitation on SubnetSelection.availabilityZones, refine the README explanation, and show a new VPC configured with explicit AZ names before filtering.

Describe any new or updated permissions being added

None. This is a documentation-only change.

Description of how you validated changes

• Built aws-cdk-lib using the dependency versions pinned by the current main branch.
• Compiled and translated the new README example with jsii-rosetta using the repository fixture.
• Executed the exact README example and confirmed that only the us-east-1a isolated subnet is selected. Also reproduced the empty selection when literal names are compared with unresolved subnet AZs and checked a cross-stack VPC reference.
• Ran jest aws-ec2/test/vpc.test.ts --runInBand --coverage=false (187 tests passed) and ESLint on vpc.ts.
• Verified that the JSDoc change leaves emitted JavaScript unchanged.
• Reviewed the documentation against the implementation and checked git diff --check.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[maintainer-for-aws]

Automated review

A maintainer will still review this — treat the notes below as a starting point.

📌 Commit aafd53b

This PR is a documentation-only clarification in the aws-ec2 module explaining why vpc.selectSubnets({ availabilityZones: [...] }) returns an empty selection when a VPC's availability zones are unresolved tokens at synthesis time, and how to avoid it by supplying explicit AZ names. It touches two files: a four-line paragraph added to the JSDoc of the pre-existing SubnetSelection.availabilityZones property in vpc.ts, and a rewritten bullet plus a runnable example in README.md.

The change adds no new public surface and alters no API shape, signature, default, or runtime behavior. The documented guidance is accurate against the implementation, and the README example is a valid VPC configuration (natGateways: 0 with a single PRIVATE_ISOLATED subnet group) that compiles. No issues found on this change.

🔴 0 blocking · 🟡 0 recommended · ⚪ 0 optional

---

Generated automatically. React 👍 or 👎 to tell us whether this review helped, so we can improve these reviews.