mlx5 ipsec_offload: ensure that driver does not dereference dead sahindex

Take the sahtree rlock and check for the DEAD SA state before validating
and filling the SA xfrm attributes.

Sponsored by: NVidia networking