vti: T6085: interface is always down and only enabled by IPSec daemon

When a VTI interface is just created, it is in ADMIN UP state by default, even
if an IPSec peer is not connected. After the peer is disconnected the interface
goes to DOWN state as expected.

This breaks routing logic - for example, static routes through VTI interfaces
will be active even if a peer is not connected.

This changes to logic so ADMIN UP/DOWN state can only be changed by the
vti-up-down helper script.

Error was introduced during the Perl -> Python migration and move to the generic
vyos.ifconfig abstraction during the 1.4 development cycle.

(cherry picked from commit 9eb018c4935235d292d7c693ac15da5761be064a)