ipsec: T3333: Fix status for SA state op-mode

[sever-sever]

Change Summary

Add checks for ESP sa state.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://phabricator.vyos.net/T3333

Component(s) name

ipsec

Proposed changes

Additional check for ESP state, without it only IKE state was checked.

How to test

Add VPN ipsec with correct ESP configuration and check

vyos@r5-roll:~$ show vpn ipsec sa
Connection                State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ----------------------------------
peer-100.64.0.2-tunnel-0  up       11m54s    0B/0B           0/0               100.64.0.2        N/A          AES_CBC_256/HMAC_SHA1_96/MODP_1024

Then change ESP settings with random values, that SA should be in "down" state:
Before patch (unexpected "UP" state):

vyos@r5-roll:~$ show vpn ipsec sa
Connection                State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ----------------------------------
peer-100.64.0.2-tunnel-0  up       11m55s    0B/0B           0/0               100.64.0.2        N/A          AES_CBC_256/HMAC_SHA1_96/MODP_1024
vyos@r5-roll:~$

After patch (expected state "DOWN"):

vyos@r5-roll:~$ show vpn ipsec sa
Connection                State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ----------
peer-100.64.0.2-tunnel-0  down     N/A       N/A             N/A               N/A               N/A          N/A
vyos@r5-roll:~$

As we see only IKE is established, but not ESP

vyos@r5-roll:~$ sudo swanctl -l
peer-100.64.0.2-tunnel-0: #3, ESTABLISHED, IKEv1, 95f37f353ad3ad72_i 8e6cdd7bc264fe23_r*
  local  '100.64.0.1' @ 100.64.0.1[500]
  remote '100.64.0.2' @ 100.64.0.2[500]
  AES_CBC-256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
  established 819s ago, reauth in 1742s
vyos@r5-roll:~$

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly