ipsec: Add tunnel fallback option

This option makes brings up a fallback tunnel if the main tracked tunnel
goes down. This is useful for when there is a failover in the VIP (which
is our main tunnel), and then we need to establish a tunnel to the new
node that has the VIP.

The fallback mechanism is a little bit hacky, but it's the only way I
could get it to work... basically it's put up in a background process,
which will keep trying retry putting up the fallback node. Meanwhile,
the resource agent will keep doing its job and put up the main node on
the host that received the VIP. eventually, a retry on the original node
will bring up the fallback tunnel.