restrict AMI slave to job with explicit label

With "NORMAL" mode, slave created by EC2 cloud plugin will be used for all jobs. An AMI may have been set to match job specific requirements/environment.
This changes let user configure slave mode for such an AMI, so that it only can be used by job that match label