This updates DHCP Options, EBS Volumes, InternetGateways, SecurityGroups, Subnets, and VPCs to specify tags at creation-time rather than calling ec2.CreateTags after the resource was created.
I didn't update NATGateway because it adds additional legacy tags that should be evaluated for whether or not they're needed.
I also didn't update SSHKey because it currently isn't tagged at all but it would be good for us to tag down the road.
* Zones are now subnets
* Utility subnet is no longer part of Zone
* Bastion InstanceGroup type added instead
* Etcd clusters defined in terms of InstanceGroups, not zones
* AdminAccess split into SSHAccess & APIAccess
* Dropped unused Multizone flag