AKS managed RBAC should cover AKS maintained CRDs

**What happened**:
Scenario is about multi-tenant cluster in which each team gets a dedicated namespace to deploy their apps.
AKS AD Auth and RBAC are used to secure access to the namespace and the objects for the developer teams.
As stated in the limitations (https://docs.microsoft.com/en-us/azure/aks/manage-azure-rbac) AKS managed RBAC does not cover custom CRDs but this will also block the creation of SecretProviderClass and therefore does not allow the developer team to manage access to KeyVault.
I get that is is probably not possible to manage access to all CRD but AKS should at least allow the management of AKS maintained CRDs like:
- SecretProviderClass
- ScaledObjects
- FluxCD

I would also expect that the builtin AKS RBAC roles especially Azure Kubernetes Service RBAC Reader and Azure Kubernetes Service RBAC Writer would also include read and write access to these CRD in a dedicated namespace scope.

**What you expected to happen**:
When impersonating an identity that has only access to a namespace I would expect to be able to create/read/update SecretProviderClass when impersonating Azure Kubernetes Service RBAC Writer role granted by AKS managed RBAC.

**How to reproduce it (as minimally and precisely as possible)**:
Create Namespace, grant AAD Identity access to namespace only, try to create/read/update a SecretProviderClass