ipsec: fix sa counters in esp-encrypt