traffic-selector: Add a hash() method
kernel-interface: Add reqid allocation and release functions

To reassign reqids where appropriate, we explicitly allocate or confirm them
centrally on the kernel-interface.

Currently the state is stored in the kernel-interface wrapper for all
backends, but we may add appropriate methods to each backend to implement
a custom reqid allocation logic, if required.
child-sa: Delegate reqid allocation to the kernel interface
child-sa: Introduce a unique CHILD_SA identifier

As the reqid is not that unique even among multiple IKE_SAs anymore, we need
an identifier to uniquely identify a specific CHILD_SA instance.
child-sa: Replace reqid based marks by "unique" marks

As we now use the same reqid for multiple CHILD_SAs with the same selectors,
having marks based on the reqid makes not that much sense anymore. Instead we
use unique marks that use a custom identifier. This identifier is reused during
rekeying, keeping the marks constant for any rule relying on it (for example
installed by updown).

This also simplifies handling of reqid allocation, as we do not have to query
the marks that is not yet assigned for an unknown reqid.
child-sa-manager: Add a global manager storing CHILD_SA relations

To quickly check out IKE_SAs and find associated CHILD_SAs, the
child_sa_manager stores relations between CHILD_SAs and IKE_SAs. It provides
CHILD_SA specific IKE_SA checkout functions wrapping the ike_sa_manager.
ike-sa: Maintain per-IKE_SA CHILD_SAs in the global CHILD_SA manager
vici: Include the CHILD_SA unique ID in list-sa event
stroke: List CHILD_SA unique ID as the primary identifier, but print reqid, too
swanctl: List CHILD_SA unique ID as the primary identifier, but print reqid, too
controller: Use the CHILD_SA unique_id to terminate CHILD_SAs
kernel-interface: Raise expires with a proto/SPI/dst tuple instead of reqid
inactivity-job: Schedule job by CHILD_SA unique ID instead of reqid
kernel-interface: Raise mapping event with a proto/SPI/dst tuple
migrate-job: Do CHILD_SA reqid lookup locally
ike-sa-manager: Remove IKE_SA checkout by CHILD_SA reqid
unity: Reference IKE_SAs by the IKEv1 COOKIEs, improving lookup performance

When handling thousands of IKE_SAs, the unique ID based lookup is rather slow,
as we have no indexing.
ike: Consistently log CHILD_SAs with their unique_id instead of their reqid