selinux: fix the labeled xfrm/IPsec reference count handling