Normalise group check DNs and LDAP DNs

Some special characters can be escaped such as ',' can be escaped either as \2c or \2C or \,
We don't care about case, because we do case insensitive matches on DNs, which isn't
entirely correct, but it's good enough.

We do care about format. Wherever we find the \xx version of a special char, we need to convert
it to the \special form, so strcmps work as expected.