kernel-netlink: Allow IPsec policies to replace shunt policies