[Feature] Allow Gatekeeper to run in AKS Automatic hosted pool

**Is your feature request related to a problem? Please describe.**
Gatekeeper pods are missing toleration for taint `kubernetes.azure.com/hostedvm` and are using nodeAffinity rule:
```yaml
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.azure.com/hostedvm
operator: NotIn
values:
- "true"
```

As result of that `system-surge` pool cannot ever scale to zero even when there is no user defined workloads running.

This would especially useful in clusters which are can idle long periods of time without any real workloads.

**Describe the solution you'd like**
Add toleration and remove mentioned node affinity rule.

**Describe alternatives you've considered**
Tested all possible ways to disable Gatekeeper but it seem to be protected in AKS Automatic.

Alternatively some kind of demo/development mode of AKS Automatic which would disabling of Gatekeeper would works.

**Additional context**
Application routing add-on have same challenge, however it can be disabled by [changing NGINX config to `None`](https://learn.microsoft.com/en-us/azure/aks/app-routing-nginx-configuration?tabs=azure-cli&pivots=nginx-ingress-controller#control-the-default-nginx-ingress-controller-configuration) and removing it's CRD with command on below:
```bash
az aks approuting update --nginx None ...
kubectl delete nginxingresscontrollers default
```