child-sa: Install drop policies while updating IPsec SAs and policies