AZ Cordon: Use tagging to restore the same NAT that was excluded

[eytan-avisror]

In the case where there are multiple NATs in a zone, and that zone is cordoned, we may restore a different NAT.
We should use tagging or similar approach to persist which NAT was cordoned so that we can restore the same NAT.

Otherwise this may cause issues for NATs which have dowstream ACLs to the public IP