ipsec: fix logic for IPSEC_CAP_BYPASS_FILTER

[kib]

Summary

The filter hooks code should be ignored if ip{4,6)_filtertunnel knob is
disabled, OR packet was already processed by IPSEC.

[ae]

I think previous logic was correct and derived from code before IPsec overhaul.

The idea of this feature is that a received packet, that was previously protected by IPsec could be trusted and thus, there is no need to pass it through the firewall.
But when user sets net.inet.ipsec.fitertunnel=1 variable, even such trusted packets must be checked. Usually this is needed to keep firewall states tracking, some network translation, or just filtering for some addresses that were hidden inside IPsec tunnel before decapsulation.