ipsec: Split the SA add_del API into an separate add and del