devfs.rules: Correctly unhide pf in vnet jails

[zlei]

Summary

The revision D26537 introduced a new devfs rule devfsrules_jail_vnet. It includes rule devfsrules_jail which include other rules. Unfortunately devfs could not recursively parse the action include and thus devfsrules_jail_vnet will expose all nodes.

Obtained from: Gijs Peskens <[e-mail]>
PR: 255660

Test Plan

service devfs restart
mount -t devfs devfs /tmp/dev
devfs -m /tmp/dev rule -s 5 applyset

and manually verify mount point.