xfrm: check state validity under lock in xfrm_state_find()

The output-cache insertion path in xfrm_state_find() checks
x->km.state == XFRM_STATE_VALID before acquiring xfrm_state_lock,
then inserts the state into pol->state_cache_list under the lock.

While this insertion block is currently unreachable -- cached is set
unconditionally at the cached: label, making the !cached guard
always false -- the correct pattern is to perform the validity
check under the lock, matching the fix in commit ddd3d01329203
("xfrm: Fix xfrm state cache insertion race") which addressed the
same TOCTOU for the input cache path.

Move the XFRM_STATE_VALID check inside the critical section so the
pattern is correct when the cache insertion becomes reachable.

Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>