if_ovpn: ensure we're in net_epoch when calling ovpn_encap()

If the crypto callback is asynchronous we're no longer in net_epoch,
which ovpn_encap() (and ip_output() it calls) expect.

Ensure we've entered the epoch.

Do the same thing for the rx path.

Sponsored by: Rubicon Communications, LLC ("Netgate")