kernel - Fix pf-based NAT

* Concurrency work on PF broke NAT.  Fix NAT for IPV4 TCP.

* This is not a complete fix, the NAT must be able to select from a range
  of local ports to replace sport to properly map the NAT onto the same
  cpu that the originating packet was forwarded to.

* Not fixed for UDP yet.
pfctl - Change default keep-policy to bring more in-line with other BSDs

* Change the default keep-policy to the equivalent of:

  set keep-policy keep state (pickups, sloppy)

* This is being done because without keep state PF is simply going to be
  too inefficient for any reasonable set of rules, and we no longer want
  to make users set the keep-policy line when keep state is already the
  default in other BSD systems.

* Note that we also set pickups and sloppy by default.  This allows the
  router and/or PF to be restarted and allows packet routing to change
  mid-stream without causing all active TCP connections to drop.  This
  may not be the default in other BSD systems but it should be.  Being
  ultra strict here to improve security against ICMP-based attacks removes
  too much flexibility to be appropriate.  Proper TCP implementations
  already do sequence space checks for RST packets.
kernel - merge fixes from FreeBSD

* Merge 8159278dbd8e019, fixes to pf_get_sport().  Primarily fixes the state
  key used to check whether a port is in-use or not.  NAT could previously
  choose a port that was already in-use.

* bzero() the state key to ensure that uninitialized fields are zero,
  otherwise the RB_FIND is likely to fail.

* Cleanup the case where there is no port range or the protocol is not
  supported.  In this situation, sport must be replicated on the host.