ipsec: rework SA replay window/SQN for MT environment