ipsec key_havesp changes

[mjg]

Summary

commit fe05dca7774e98adfeb1faefe8b98d6b398eae53 (HEAD -> ipsec)
Author: Mateusz Guzik <[e-mail]>
Date:   Wed Sep 7 22:05:38 2022 +0200

    ipsec: add key_havesp_any
    
    Saves on work in a common case of checking both directions.
    
    Note further work in the area is impending to elide these in the common
    case to begin with.
    
    Reviewed by:
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:

commit bec3c2d77d20bcc76a92f86f7340d1008b6e847d
Author: Mateusz Guzik <[e-mail]>
Date:   Wed Sep 7 22:27:15 2022 +0200

    ipsec: prohibit unknown directions in key_havesp
    
    Eliminates a branch checking for its validity.
    
    Reviewed by:
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:

compiled in but disabled ipsec shows up on profiles, see https://github.com/ocochard/netbenches/blob/master/Xeon_E5-2697Av4_16Cores-Mellanox_ConnectX-4/firewalls/results/fbsd14-n277887-IPSEC/README.md

the above is an initial step towards fixing that problem

later I'm going to create a combined var recalculated on each V_forwarding + key_havesp_any change so that no function calls will be issued to begin with.

this in ip_input:

        if (V_ipforwarding != 0
#if defined(IPSEC) || defined(IPSEC_SUPPORT)
            && (!IPSEC_ENABLED(ipv4) ||
            IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0)
#endif
            ) {

will collapse into

if (V_ipcantryforward != 0) {