ipsec: globalize lft zone and zero out buffers at allocation time

[mjg]

Summary

Creation of a zone is expensive and there is no need to have one for
every vnet. Moreover, this wastes memory as these separate zones
cannot use the same per-cpu caches. Finally, this is a step towards
replacing the custom zone with pcpu-16.

Two counter_u64_zero calls induce back-to-back IPIs to zero everything
out. Instead, pass the M_ZERO flag to let uma just iterate all buffers.
The counter(9) API abstraction is already violated by not using
counter_u64_alloc.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Test Plan

sys/netipsec/tunnel/aes_cbc_128_hmac_sha1:v4 -> passed [0.209s]
sys/netipsec/tunnel/aes_cbc_128_hmac_sha1:v6 -> passed [0.224s]
sys/netipsec/tunnel/aes_cbc_256_hmac_sha2_256:v4 -> passed [0.194s]
sys/netipsec/tunnel/aes_cbc_256_hmac_sha2_256:v6 -> passed [0.183s]
sys/netipsec/tunnel/aes_gcm_128:v4 -> passed [0.206s]
sys/netipsec/tunnel/aes_gcm_128:v6 -> passed [0.195s]
sys/netipsec/tunnel/aes_gcm_256:v4 -> passed [0.191s]
sys/netipsec/tunnel/aes_gcm_256:v6 -> passed [0.174s]
sys/netipsec/tunnel/aesni_aes_cbc_128_hmac_sha1:v4 -> passed [0.194s]
sys/netipsec/tunnel/aesni_aes_cbc_128_hmac_sha1:v6 -> passed [0.211s]
sys/netipsec/tunnel/aesni_aes_cbc_256_hmac_sha2_256:v4 -> passed [0.176s]
sys/netipsec/tunnel/aesni_aes_cbc_256_hmac_sha2_256:v6 -> passed [0.196s]
sys/netipsec/tunnel/aesni_aes_gcm_128:v4 -> passed [0.177s]
sys/netipsec/tunnel/aesni_aes_gcm_128:v6 -> passed [0.180s]
sys/netipsec/tunnel/aesni_aes_gcm_256:v4 -> passed [0.184s]
sys/netipsec/tunnel/aesni_aes_gcm_256:v6 -> passed [0.176s]
sys/netipsec/tunnel/empty:v4 -> passed [0.188s]
sys/netipsec/tunnel/empty:v6 -> passed [0.196s]

[ae]

I have no objection.