When user identifiers are submitted, what about normalizing them before hitting the rate-limiter and then the provider?
That'd allow easier comparisons, and maybe some more hardening against spoofing/confusables.

Related to #49268

A simple normalizer could eg lowercase + turn them in NFKC.