Add to if_enc(4) ability to capture packets via BPF after pfil processing.

New flag 0x4 can be configured in net.enc.[in|out].ipsec_bpf_mask.
When it is set, if_enc(4) additionally captures a packet via BPF after
invoking pfil hook. This may be useful for debugging.

Sponsored by:	Yandex LLC