Only record an IPSEC_OUT_DONE tag when we have finished the processing In ip{,6}_output, check this tag to know if we have already processed this packet. Remove some dead code (IPSEC_PENDING_TDB is not used in NetBSD) Fix pr/36870