Only build ipsec modules if the kernel includes IPSEC_SUPPORT.

[jhb]

Summary

Honoring the kernel-supplied opt_ipsec.h in r361632 causes builds of
ipsec modules to fail if the kernel doesn't include IPSEC_SUPPORT.
However, the module can never be loaded into such a kernel, so only
build the modules if the kernel includes IPSEC_SUPPORT.

Test Plan

• MALTA64 (currently broken) now builds ok by skipping these two modules
• GENERIC (amd64) still builds these two modules

[bdragon]

This fixes build failures I was just seeing on my RB800 powerpcspe test board.

[imp]

This is fine... it does highlight a bit more the impedance mismatch between kernel build and stand alone builds as options bleed out of the kernel...

It's not the first one, though, and it's done in the same way as the others, so no objections.

[jhb]

I feel like it's the first one where we are using KERN_OPTS instead of MK_FOO. I think this is the right direction though, and I even think we should be using KERN_OPTS instead of MK_INET_* even so that we wouldn't include kernel modules that require INET for kernel configs that don't include INET, etc. (e.g. LINT-NOIP).

[jhb]

In particular, LINT-NO* wouldn't have to use WITHOUT_INET_* variables in makeoptions if we switched the module Makefiles over to using KERN_OPTS instead of MK_INET_*. Simply removing INET from a kernel config would turn off the requisite modules.