ITS#9664 Add normalised suffix into rootDSE for ACL, etc.

This was removed in ITS#5540 since there was no EQUALITY matching rule, but that situation changed in ITS#8341 and we need to add it back.