child-rekey: Uninstall old outbound SA earlier on initiator/winner

child-rekey: Uninstall old outbound SA earlier on initiator/winner

This is useful for kernel implementations where the ordering of SAs
is unpredictable and the new SA might otherwise not be used until the
DELETE response has been received, which is not ideal as the responder
might not keep the old SA around that long.  On Linux, it makes no
difference as we switch to the new outbound SA immediately because the
updated outbound policy references its SPI.