resource/aws_vpc_endpoint: Support tag-on-create (#12288)

Output from acceptance testing in AWS Commercial:

```
--- PASS: TestAccAWSVpcEndpoint_gatewayBasic (26.57s)
--- PASS: TestAccAWSVpcEndpoint_gatewayPolicy (43.56s)
--- PASS: TestAccAWSVpcEndpoint_gatewayWithRouteTableAndPolicyAndTags (44.88s)
--- PASS: TestAccAWSVpcEndpoint_interfaceBasic (62.99s)
--- PASS: TestAccAWSVpcEndpoint_interfaceNonAWSService (269.75s)
--- PASS: TestAccAWSVpcEndpoint_interfaceWithSubnetAndSecurityGroup (385.21s)
--- PASS: TestAccAWSVpcEndpoint_removed (22.86s)
```

Output from acceptance testing in AWS GovCloud (US):

```
--- PASS: TestAccAWSVpcEndpoint_gatewayBasic (26.87s)
--- PASS: TestAccAWSVpcEndpoint_gatewayPolicy (33.87s)
--- PASS: TestAccAWSVpcEndpoint_gatewayWithRouteTableAndPolicyAndTags (47.08s)
--- PASS: TestAccAWSVpcEndpoint_interfaceBasic (35.65s)
--- PASS: TestAccAWSVpcEndpoint_interfaceNonAWSService (267.19s)
--- PASS: TestAccAWSVpcEndpoint_interfaceWithSubnetAndSecurityGroup (296.54s)
--- PASS: TestAccAWSVpcEndpoint_removed (20.03s)
```

aws/resource_aws_vpc_endpoint.go

@@ -154,6 +154,7 @@ func resourceAwsVpcEndpointCreate(d *schema.ResourceData, meta interface{}) erro
 		VpcEndpointType:   aws.String(d.Get("vpc_endpoint_type").(string)),
 		ServiceName:       aws.String(d.Get("service_name").(string)),
 		PrivateDnsEnabled: aws.Bool(d.Get("private_dns_enabled").(bool)),
+		TagSpecifications: ec2TagSpecificationsFromMap(d.Get("tags").(map[string]interface{}), "vpc-endpoint"),
 	}
 
 	if v, ok := d.GetOk("policy"); ok {
@@ -187,12 +188,6 @@ func resourceAwsVpcEndpointCreate(d *schema.ResourceData, meta interface{}) erro
 		return err
 	}
 
-	if v, ok := d.GetOk("tags"); ok {
-		if err := keyvaluetags.Ec2UpdateTags(conn, d.Id(), nil, v.(map[string]interface{})); err != nil {
-			return fmt.Errorf("error updating tags: %s", err)
-		}
-	}
-
 	return resourceAwsVpcEndpointRead(d, meta)
 }