This introduces a device independent napi instance that handles GRO for IPsec. I was not able to use gro cells directly because I don't have a netdevice where I can hang off the napi instance. We now may have a secpath at a GRO merged skb, so we need to drop it. This is the only cange to the generic networking code.
The packet still travels two times through the stack, but might be aggregated in the second round. We can avoid the second round with implementing GRO callbacks for the IPsec protocols. This will be a separate patchset as this needs some more generic networking changes because of the asynchronous nature of IPsec.
