Remove allow_kube_tls rule when no masters as is not required

[marrobi]

What this PR does / why we need it:

Removes the allow_kube_tls rule from the network security group. This rule allows traffic from Any source to any destination on port 443, and it being present prevents traffic inbound to 443 being further restricted on the NSG.

For example when creating a rule to restrict ingress traffic on 443 to a specified IP range using loadBalancerSourceRanges this has no affect as the allow_kube_tls allows all traffic.

The annotation on the allow_kube_tls rule is "Allow kube-apiserver (tls) traffic to master", if there are masters (i.e. not AKS), then the rule is still added (defined in kubernetesmasterresources.t ) in the existing code below:

  {{if not IsHostedMaster}}
      ,{{template "k8s/kubernetesmasterresources.t" .}}
    {{else}}

Feedback welcome.

Special notes for your reviewer:
I cannot think of any issues removing this rule would create to existing users, I have manually removed it from a couple of my clusters and operations do not seem to be affected.

If applicable:

• documentation
• unit tests
• tested backward compatibility (ie. deploy with previous version, upgrade with this branch)

[acs-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: marrobi
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: cecilerobertmichon

If they are not already assigned, you can assign the PR to them by writing /assign @cecilerobertmichon in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[CecileRobertMichon]

I believe this is a duplicate of #4085 & #4164. If I'm wrong please reopen in https://github.com/Azure/aks-engine.