Because of IPAM allocation, we can't know the parent CIDR at synth
time, so we cannot calculate the CIDR split at synth time either.

This forces us to rely on the `{ Fn::Cidr }` function provided by
CloudFormation. For resource consumption reasons, this function is
limited to splitting any range into at most 256 subranges, which means
the IPAM allocated VPC cannot split into more subranges either.

This PR adds a recursive split feature: if we need to split an
CIDR range more than 256 times, we will do multiple splits:

```ts
Fn.select(300, Fn.cidr(range, 4096, 4)) // <-- illegal

// ==

Fn.select(44, Fn.cidr(Fn.select(1, Fn.cidr(range, 4, 12)), 256, 4))
```