android: base-cfg: enforce the needed XFRM_MODE_TUNNEL (for VPN)