[NETFILTER+IPSEC 2/4]

This patch makes packets decapsulated by IPsec traverse the netfilter input
hooks again. Packets traverse the hooks like this:

1. -> (encrypted) PRE_ROUTING -> LOCAL_IN -> (plain) PRE_ROUTING -> LOCAL_IN
2. -> (encrypted) PRE_ROUTING -> LOCAL_IN -> (plain) PRE_ROUTING -> FORWARD
