My custom-rules.xml was working fine.
After upgrade, my custom-rules.xml is still present in
/usr/local/opnsense/scripts/suricata/metadata/rules/custom-rules.xml but it's no longer appearing in the GUI:
Services > Intrusion Detection > Administration > Download
Interestingly it's still in the policy section.
It looks like the 21.7.3 upgrade to suricata 6.0.3_2 has lost the ability to load custom.xml rules.
Oh no!
My fault. I forgot, you must escape any amersands in the URL for parsing.
Ampersand: & must be replaced with &