feat(ipsec-xfrm): carry NAT-T encapsulation through IKEv2 Child-SA mapping

[VerifiedOrganic]

Problem

The generic XFRM model and Linux backend support UdpEncap and XFRMA_ENCAP, but Ikev2ChildSaXfrmRequest cannot express UDP encapsulation. The mapper currently sets both generated SA requests to encap: None.

A consumer mapping an ESP-in-UDP Child SA must therefore mutate the returned requests out of band or bypass the typed mapper. Otherwise, the mapped state describes native ESP and can blackhole encapsulated traffic.

Requested boundary

• Add explicit directional NAT-T inputs, or an equivalent validated directional configuration, to Ikev2ChildSaXfrmRequest.
• Project those values into the inbound and outbound SaParameters::encap fields.
• Preserve exact existing behavior and bytes when both values are None.
• Reuse a shared redaction-safe encapsulation validation contract.
• Keep NAT detection and translated-port selection caller-owned.

Tests

• Native ESP maps both directions to None.
• Symmetric UDP/4500 maps both directions exactly.
• Direction-specific translated ports map to the correct inbound and outbound templates.
• Invalid zero-port or encapsulation-type configurations fail with stable, value-free errors.
• Existing keys, selectors, request IDs, and policy mappings remain unchanged.

Scope

This covers initial IKEv2 Child-SA-to-XFRM projection only. It does not add post-establishment NAT-rebinding observation or SA relocation behavior; those are separate from the initial mapping boundary.