add ipsec policy matching

This adds support for ipsec policy matching.

I've been using this code for over a year now. However the only thing I am not certain about is the order of the parameter on [line 106](https://github.com/phemmer/puppetlabs-firewall/commit/3eb9919fdc8d8c8d98c626aab744af29cc53a9ad#diff-14bcf0413d55d21f486f643f82fce2e7R106). This appears to be the right spot, but that was just determined through trial and error.