Bump to squid 3.4.6 and use pf instead of ipfw

Per http://www.hanynet.com/waterroof/
```
IPFW HAS BEEN DEPRECATED IN MAC OS X 10.7 LION.
IPFW works as usual and is a very good choice also on Lions but has been officially replaced by PF. Technically IPFW and PF work together. Connections must be allowed (=not blocked) by both firewalls in order to pass. 
PF is now the default firewall in OSX. WaterRoof does not support the configuration of PF. 
hanynet.com is proud to present the first free frontend for the OS X PF firewall: IceFloor.

IPFW HAS BEEN COMPLETELY REMOVED FROM OS X 10.10 YOSEMITE (Developer Preview 1).
IPFW has gone forever. WaterRoof development has been discontinued today, june 5 2014.
```