Separate Zones per Subscriber VPC

[freimer]

Currently, all new tunnels are added to the UNTRUST zone on the firewalls to which they are connected. There should be a new zone created per subscriber VPC and the tunnels for the new VPC connection added to the new zone. The zone name can be provided in the subscriber VPC CFT.