Exclude certain hosts in Germany and Austria from any changes, while turning MDM on for everyone else

[dherder]

gong call

---

Problem

The original scope of #9956 included support for multiple APNs connections per Fleet server (APNs per team). This was de-scoped: see this comment, specifically in the Requirements section "Each team can be configured with a separate APNS cert/key and DEP token. UPDATE: Might not be necessary. We can use one APNs cert/key pair for many customers (noahtalerman 2024-07-03).".

this is needed by prospect-redwine. why? in order to isolate some devices that cannot be MDM enrolled due to privacy concerns, we need to be able to turn on/off MDM on a per-team basis. The only other solution would be to deploy 2 different Fleet servers, which is not a desirable solution.

[noahtalerman]

Hey @dherder, has this made it into an order form for redwine? To take prospect requests it has to be in an order form.