Try to improve the usability around VPCs and certain Subnet Type
configurations.

- Make clear that ISOLATED does not mean "no Internet access at all",
  just no Internet access from the point of view of the current VPC.

- If people configure natGateways=0, tell them that they probably meant
  to configure no PRIVATE subnets.

- If people DO configure PRIVATE subnets, make sure they also configure
  PUBLIC subnets, otherwise we won't be able to place the NAT gateways
  anywhere useful.

- If people end up with a VPC without PRIVATE subnets, the default
  behavior of `selectSubnets` is pretty useless, because it can never
  work, and that's not what people are used to from the CDK. Dynamically
  adjust the selection default to whatever subnet types *are* available.

Fixes #3704.

…t-types