ipsec: enter epoch before calling into ipsec_run_hhooks

pfil_run_hooks which eventually can get called asserts on it.

Reviewed by: ae
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32007

(cherry picked from commit 590d0715b348d0d8da0c0355cebd9dff18e39831)