[Bug] Fix is_subnet_public to use main route table for subnets without explicit association

[almightychang]

Summary

• Fix is_subnet_public() to correctly identify public subnets that use the VPC's main route table
• When a subnet has no explicit route table association, find the main route table instead of using route_tables[0]
• Add explicit error handling when main route table cannot be found

Root Cause

When a subnet has no explicit route table association, it implicitly uses the VPC's main route table. The previous implementation fetched all VPC route tables but only checked route_tables[0], which may not be the main route table. This caused public subnets (using main route table with IGW) to be incorrectly identified as private.

Changes

cli/src/pcluster/aws/ec2.py

• Find main route table by checking Associations[].Main flag
• Raise explicit exception if main route table not found

cli/tests/pcluster/aws/test_ec2.py

• Add helper functions for mocking route table responses
• Add test for subnet using main route table with IGW (public)
• Add test for subnet using main route table without IGW (private)

Test plan

• Existing test_is_subnet_public passes
• New test_is_subnet_public_with_main_route_table passes
• New test_is_subnet_public_main_route_table_no_igw passes

Fixes #7173