Implement lowering 'proto' and 'protochain'

* src/pf/expand.lua: Implement lowering 'proto'. Lowering of 'protochain' is very complex so it's marked as NYI.
* src/pf/parse.lua: Support keywords 'proto' and 'protochain'.
* doc/Makefile: Add example.
* doc/proto-sctp.md: Add example 'proto sctp'.
likewise pull out the "ip" test to the head here