vrrp: drop stale adverts before the auth_hmac digest

A flood of adverts forced an HMAC-SHA256 per packet before the freshness
check could reject them. Move the time window check ahead of the digest
so replayed stale captures are shed cheaply. The replay high water mark
stays after the MAC, it must never move on forged data. This helps only
in time mode, monotonic mode has no window to filter on.

Signed-off-by: Alexandre Cassen <acassen@gmail.com>