sbappend_ktls_rx() read the receiving interface of each packet header
it demotes from the chain's first mbuf, whose header it had zeroed on
the first pass. A chain of two packets or more thus had no interface,
and a change of input interface went unnoticed: the TLS receive tag
stayed on the old interface until a later append of one packet. Read
it from the packet being demoted, as the decrypted mark is.

Found with CBMC.

Fixes: fe8c78f0d202 ("ktls: Add full support for TLS RX offloading via network interface.")