Auth-to-local rule generation duplicates default rules when adding case-insensitive default rules

When re-generating auth-to-local rules where existing rules are already set, the default (or fallback) rule for the default and additional realms is duplicated but the extra instance(s) have the case-insensitive flag:

Example:

...
RULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//
...

...
RULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//
RULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*///L
...

Steps to Reproduce

1. Create cluster with (at least) HDFS
2. Enable Kerberos (do not check the box next to "Enable case insensitive username rules"; kerberos-env/case_insensitive_username_rules should be false
3. Edit Kerberos configuration and check "Enable case insensitive username rules" to set kerberos-env/case_insensitive_username_rules to true
4. Regenerate Keytabs
5. See duplicate entry in HDFS configs (core-site/hadoop.security.auth_to_local)