Launch into a private subnet by default

[mathcolo]

#71 going in means gobble doesn't need a public IPv4 address. But the current public subnets auto-assign public IPv4 addresses (and need to for NTT and RRE), so we should:

a) Create a private subnet
b) Codify that private subnet in gobble's CF.

[mathcolo]

Note: by "private" I actually really mean "public, but with auto-assign IPv4 off". Still has outbound internet access!