test /32 negotiation and failure shunts when group is /32

test the interops

- success

- IKE_SA_INIT proposal rejected

  once IKE_SA_INIT is sent, should see negotiation shunt; check ping

  once IKE_SA_INIT times out, should see failure shunt; check ping

- IKE_AUTH proposal rejected

  while negotiating, should see negotiation shunt (it's a bit racy).

  once child is rejected, should see failure shunt; check ping

with:

  negotiationshunt={drop,pass}
  failureshunt={none,drop,pass}

the negotiation/failure shunts should eclipse the group's /32
