Define identity normalization and case sensitivity rules

[rlippmann]

Define the contract for identity matching and normalization.

Questions to resolve:

• Which parts of directives are case-insensitive?
• Are state identifiers case-insensitive?
• Is normalization used only for lookup or also for storage?
• Should original display casing be preserved?
• How should duplicate detection and removal behave?

Related areas:

• policy identity
• state lookup
• directive matching