Up to now ipsecctl(8) grouped SAs with identical src and dst to the

Up to now ipsecctl(8) grouped SAs with identical src and dst to the
flow which the first SA matched by the flow type.  This behaviour
was mostly undocumented and unexpected.  Make SA bundles explicit
in ipsec.conf(5).  Only group SAs that have the same src and dst
and also the same bundle identifier.
OK hshoexer@