Tighten is_numeric()

Improvements:

1) avoids need for 'expensive' preg_match()
2) mistakenly deems an empty string or anything converted to an empty string, as a 'numeric' value

(Issue example: if an empty string can validate as numeric, it's possible that empty strings may end up in strings used for rules or subnet bitcounts, causing unexpected pf rule creation, errors or vulnerabilities)

 -- also moved code to a more logical place in the .inc while doing this, not mixed in between IP handling functions