Remove any stale mbuf tags from packets being injected into a netgraph
graph.  In particular, this solves some issues with (probably leaked)
IPSec-related tags being looped back through netgraph to the inbound
path which then misinterpreted the stale tags.

MFC after:	7 days
MFV r267567:

4881 zfs send performance degradation when embedded block pointers are
     encountered

illumos/illumos-gate@06315b795c0d54f0228e0b8af497a28752dd92da

MFC after:	2 weeks
The assumption in ipsec4_process_packet() that the payload may be
only IPv4 is wrong, so check the IP version before mangling the
payload header.
MFV r267568:

4891 want zdb option to dump all metadata

illumos/illumos-gate@df15e419cb7359ba56ddddab9045e438d89e7cbc

MFC after:	2 weeks