Better order #includes (dependencies are a mess).
Add struct encrypt_desc.pad_to_blocksize; only pad IKE packets when needed

CTR mode doesn't need need to be padded to any block size; but a
padding-length of 0 still needs to be appended.  On receiving end
be more permissive.