CFR: fast ipsec locking

[Sam Leffler]

http://www.freebsd.org/~sam/fastipsec.patch

These changes add locking and cleanup some of the infrastructure; e.g. to 
do better accounting of dynamically allocated data structures.

Basic operation is well-tested but I haven't done extensive testing of the 
re-keying (e.g. with racoon).  There is one known performance bottleneck: 
the lock in the ipsecrequest structure is held for every outbound packet to 
guard against modification to the data structure.  This looks to be fixable 
by redoing the SADB but won't happen for a while.  Note that with these 
changes much of fast ipsec runs Giant-free because the crypto code is 
already Giant-free.  I did some performance measurements a while back with 
this code and a Giant-free em driver and got netperf results over a 
h/w-accelerated 3DES+SHA1 tunnel that was about the same as -stable.

	Sam