ipsec: serialize SPI allocation

[mjg]

Summary

two commits:

ipsec: add a lock encompassing SPI allocation

SPIs get allocated and inserted in separate steps. Prior to the change
there was nothing preventing 2 differnet threads from ending up with the
same one.

ipsec: fix edge case detection in key_do_getnewspi

The 'count' variable would end up being -1 post loop, while the
following condition would check for 0 instead.

Test Plan

kyua test sys/netipsec

internal testing at netgate

[mjg]

sys/netipsec/key.c

219

i tried an mtx lock but it ran into problems with apparent malloc called with M_WAITOK down the line

[ae]

sys/netipsec/key.c

5651

missing SPI_ALLOC_UNLOCK();

6046

It seems the locking here needed only to satisfy KASSERT in key_do_getnewspi(). So you can unlock here and remove SPI_ALLOC_UNLOCK() in each following condition.

6262

the same, only one SPI_ALLOCK_UNLOCK() here needed.

[mjg]

sys/netipsec/key.c

6261

key_getsavbyspi does not need the lock per se but I would argue it is more future-proof to keep it