east does not yet run libreswan. Road attempts OE, and installs a %pass.
east is then started and triggered by a packet and initiated OE to
road. Road must replace the %pass with the tunnel.

because both ends are private-or-clear, and the ping on east sends more
than one ping, both ends will trigger OE to each other.

NOTE: we end up with two states but one set of policies in the kernel ????
      This might cause problems if one of the two tunnels is deleted

NOTE: this test case no longer needs to wait for shuntlifetime= because
      the shunt is now immediately replaced when an IPsec SA that matches
      the (now obsolete) %pass is installed. Test can be updated later to
      not wait for a shuntscan check. The pluto shunt table entry
      is deleted. the netlink call to delete the kernel policy it cut
      short in the case of %pass shunts, since it auto-replaces already.

NOTE: A keyingtries=0 really makes no sense for OE. After the first keying try
the failure shunt is installed. And the keying attempts should die or else they
are just added from all nodes that dont run OE.
