fix(aws-ec2): CfnNetworkAclEntry.CidrBlock should be optional

The docs say this property is optional (exactly one of `CidrBlock`
and `ipv6CidrBlock` should be specified) but it's typed as `Required`
in the JSON schema.

Patch the schema until this is fixed upstream.

Fixes #1517.

packages/@aws-cdk/aws-ec2/test/test.l1.ts

@@ -0,0 +1,19 @@
+import cdk = require('@aws-cdk/cdk');
+import { Test } from 'nodeunit';
+import ec2 = require('../lib');
+
+export = {
+  'NetworkAclEntry CidrBlock should be optional'(test: Test) {
+    const stack = new cdk.Stack();
+
+    new ec2.CfnNetworkAclEntry(stack, 'ACL', {
+      // Note the conspicuous absence of cidrBlock
+      networkAclId: 'asdf',
+      protocol: 5,
+      ruleAction: 'action',
+      ruleNumber: 1
+    });
+
+    test.done();
+  },
+};

packages/@aws-cdk/cfnspec/spec-source/500_NetworkAclEntry_patch.json

@@ -0,0 +1,16 @@
+{
+    "ResourceTypes": {
+        "AWS::EC2::NetworkAclEntry": {
+            "patch": {
+                "description": "https://github.com/awslabs/aws-cdk/issues/1517",
+                "operations": [
+                    {
+                        "op": "add",
+                        "path": "/Properties/CidrBlock/Required",
+                        "value": false
+                    }
+                ]
+            }
+        }
+    }
+}