tcp6: don't move IP6CB before xfrm6_policy_check()