remove need to know vpn/vpn2 subnets by name

[thecaffiend]

We have a lot of places that need to know about the vpn/vpn2 subnets by name right now. That's not good as we shouldn't be beholden to specific names. Also, if we add another availability zone, we'd now have a vpn3 or something, and that would have to wired in in a lot of places.

One thing to consider is adding a type to each subnet and have special handling for known types (but don't require a type to be known to be created). So we could have "vpn" type that we cue off of, or "compute" or whatever.