[Feature] Enable Independent Use of ASGs in AKS for Custom NSG Configuration

Currently, Azure Kubernetes Service (AKS) does not allow users to utilize Application Security Groups (ASGs) for custom purposes, even though the AKS API includes an asg_ids attribute (a list of strings). This attribute is explicitly tied to the allowed_hostports feature, which automatically creates and applies a Network Security Group (NSG). Unfortunately, this implementation is unsuitable for scenarios where users need to define their own NSGs—for example, to allow or block specific node pools.

The current limitation prevents users from leveraging ASGs dynamically in AKS, even though the underlying functionality appears to exist. This creates unnecessary complexity for scenarios where multiple AKS clusters share the same Virtual Network (VNet) and require logical separation.

*Proposed Solution*
The solution is straightforward: decouple the use of ASGs from the allowed_hostports feature and make the existing functionality available independently. Specifically:

Allow users to deploy an empty ASG.
Enable users to assign this ASG to a node pool (VMSS) when creating/changing an AKS cluster.
By implementing this, users could configure their own NSGs dynamically using ASGs without being forced to use allowed_hostports. This would provide more flexibility while leveraging existing AKS functionality.

*Current Alternatives*
At present, the lack of independent ASG support forces users to rely on subnet-based boundaries and subnet-level NSGs. This approach has several drawbacks:

Rules must be created using CIDRs, leading to less efficient CIDR usage.
Subnet-level NSGs are less dynamic compared to ASGs, which can automatically adjust to changes in associated resources.
This workaround introduces unnecessary complexity and inefficiency, especially in environments where multiple AKS clusters share the same VNet.

*Additional Notes*
The AKS API currently accepts unvalidated asg_ids, even if the provided ID is invalid, as long as allowed_hostports is not configured. However, the Azure CLI (az-cli) enforces validation, making it impossible to use asg_ids without enabling allowed_hostports. This inconsistency is problematic, as validation should occur at the API level, not in the client.
By addressing this issue, Microsoft could significantly enhance the flexibility and usability of AKS for advanced networking scenarios.

This feature would be a small but impactful improvement, leveraging existing functionality to address a common limitation in AKS networking.