check for oversize ESP packets, with 256 bytes of headroom above calculated MTU

check for oversize ESP packets, with 256 bytes of headroom above calculated MTU

Because GlobalProtect VPNs have no practical mechanism for negotiating the
MTU whatsoever, it is entirely based on a client-side guess.  Therefore,
extra headroom is needed to reliably receive packets via both the HTTPS and
the ESP tunnels.

A similar patch by Nikolay Martynov <mar.kolya@gmail.com> was originally
applied for the Juniper HTTPS tunnel:
http://lists.infradead.org/pipermail/openconnect-devel/2017-May/004320.html

And similar functionality was incorporated into the GlobalProtect HTTPS
tunnel as well (gpst.c).

This patch adds the extra headroom for the ESP tunnel (used by both Juniper
and GlobalProtect VPNs) as well, after unexpectedly-large ESP packets were
observed "in the wild":
https://github.com/dlenski/openconnect/issues/96

Signed-off-by: Dan Lenski <dlenski@gmail.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>