[Feature] AKS should not propagate unconditionally its tags onto resources it did not create

**Is your feature request related to a problem? Please describe.**
Yes, we deploy our intrastructure in several TF modules:

1. VNET, subnets, routing tables - used by many
2. AKS - using the VNET from (1)
3. Bootstrap - deploy apps to AKS using helm, including external ingress, which comes with an `azurerm_public_ip` resource

We tag the resources we deploy with the name of the respective TF component. This helps us to identifies owners of the different infrastructure pieces.

AKS does not own the routing tables and neither does it own the public ip resource, but it propagates its tags onto them nonetheless. Including the TF ownership tag.

This behavior was implemented as a result of #1200, however, we think the definition of "dependent" is too broad. We think AKS should unconditionally tag the resources it owns, because it creates them.

**Describe the solution you'd like**
A flag controlling the propagation of the tags to the resources used by AKS, but not owned by it. The flag could be a simple boolean with the default affirming the current behaviour, but which could be used to suppress it. Only for the resources NOT created by AKS.

**Describe alternatives you've considered**
There are no alternatives that would not include cramming all public IP and routing tables in the same module with AKS.

**Additional context**
We use terraform azurerm module `3.42`