Defer CHILD_SA rekeying if allocating an SPI fails