kernel: Add options to control DF and ECN header bits/fields via XFRM

The options control whether the DF and ECN header bits/fields are copied
from the unencrypted packets to the encrypted packets in tunnel mode (DF only
for IPv4), and for ECN whether the same is done for inbound packets.

Note: This implementation only works with Linux/Netlink/XFRM.

Based on a patch by Markus Sattler.

src/libcharon/sa/child_sa.c

@@ -891,6 +891,8 @@ static status_t install_internal(private_child_sa_t *this, chunk_t encr,
 		.encap = this->encap,
 		.hw_offload = this->config->get_hw_offload(this->config),
 		.esn = esn,
+		.copy_df = !this->config->has_option(this->config, OPT_NO_COPY_DF),
+		.copy_ecn = !this->config->has_option(this->config, OPT_NO_COPY_ECN),
 		.initiator = initiator,
 		.inbound = inbound,
 		.update = update,