AZ Cordon: Use tagging to restore the same NAT that was excluded

In the case where there are multiple NATs in a zone, and that zone is cordoned, we may restore a different NAT.
We should use tagging or similar approach to persist which NAT was cordoned so that we can restore the same NAT.

Otherwise this may cause issues for NATs which have dowstream ACLs to the public IP