pfctl - Fix pf_print_state

* Fix a bug where the 'minutes' field in the expiration was not being
  calculated properly.

* Reformat the verbose output so it does not overflow 80 columns, and
  move the rule # printing up a little so it is not confusedly associated
  with the next entry.
pf - make the bulk of PF concurrent under normal operation

* state and ip fragment tables are now per-cpu.

* packet paths acquire pf_token shared instead of exclusive.  Packet
  processing runs concurrently.

* Any dynamic rules updates will run synchronously for now.

* State expiration from the pfpurge thread runs synchronously for now.
  More work can be done here.

* ioctl (and also pfsync) paths acquire pf_token exclusively.  That is,
  primarily pfctl commands.  This includes rules updates and state scans.
  More work can be done here.
buildworld - Add sync/sleep safety before mkinitrd

* Try to mitigate a bug in earlier versions of DragonFly that can be
  triggered by mkinitrd's use of the VN device by ensuring that the world
  is synced to disk before running mkinitrd.