IKEv2: force the log-limiter code to kick in

- west sends crafted UDP packets to east on both port 500 and port
  4500

  This includes an empty packet, which is correctly interpreted as a
  NAT keepalive.

- exercises iface_udp.c paths: too-small, no Non-ESP marker, spurious
  non-ESP marker, NAT-T keep-alive

- exercises demux.c path: mangled IKE header

- verifies rate-limiter sentinel fires at limit and suppresses beyond

- verifies pstats_ike_mangled increments even when logs are suppressed
