ipsec: extend vnet coverage in esp_input/output_cb

key_delsav used to conditionally dereference vnet, leading to panics as
it was getting unset too early.

While the particular condition was removed, it makes sense to handle all
operations of the sort with correct vnet set so change it.

Reviewed by: ae
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34313