[WM] add support for additional NAT source CIDRs
[WM] add support for additional NAT source CIDRs

We'll use this to allow NAT'ing some traffic from VPN clients (to IP
whitelisting peers, for example).

cap10morgan/aws-vpc-nat-instance-cookbook