Properly handle RFC5280 DNS Name Constraints that start with a dot as in mozilla::pkix