child-create: Fix crash when responder doesn't send TS payloads

There are multiple paths that can trigger a crash.  One is if transport
mode is negotiated via NAT and `get_transport_nat_ts()` is called to
substitute addresses in the received TS.  If that's not the case,
`narrow_ts()` will select the configured TS and continue.  Then,
`narrow_and_check_ts()` eventually attempts to destroy `this->tsi/tsr`,
which triggers a crash in any case.

The referenced commit refactored `select_and_install()` into
`narrow_and_check_ts()` and `install_child_sa()`.  It move a check
for TS from that function to only `build_r()`.

Fixes: d7760416d6 ("child-create: Add support for multiple key exchanges")

src/libcharon/sa/ikev2/tasks/child_create.c

@@ -2712,6 +2712,13 @@ METHOD(task_t, process_i, status_t,
 
 	process_payloads(this, message);
 
+	if (!this->tsi || !this->tsr)
+	{
+		DBG1(DBG_IKE, "TS payloads missing in message");
+		handle_child_sa_failure(this, message);
+		return delete_failed_sa(this);
+	}
+
 	if (!select_proposal(this, no_ke))
 	{
 		handle_child_sa_failure(this, message);