ikev2: fix non-matching SPIs during rekey