child-sa: Add method to associate rekeyed CHILD_SAs with their replacement