Fix IPSEC_DEBUG in ipsec.ko

[jhb]

Summary

Honor opt_ipsec.h from kernel builds.

To make this simpler, set the default contents of opt_ipsec.h
for standalone modules in sys/conf/config.mk.

Consistently include opt_ipsec.h for consumers of <netipsec/ipsec.h>.

This fixes ipsec.ko to include all of IPSEC_DEBUG.

Test Plan

• tried to debug an OCF regression caught by ipsec and found that debug traces in xform_esp.c weren't working in ipsec.ko

[jhb]

This would be two commits, with logs as in the description, one to change opt_ipsec.h generation for modules and one to fix the #includes.