pf: ensure mbufs are writable

[kp]

Summary

Ensure that we can modify mbufs before we start processing them. There are a
number of paths where pf will m_copyback() or otherwise modify a packet. Ensure
that this is safe to do.

For example, ip6_forward() will m_copym() the packet before handing it to the
output pfil hook. This results in a non-writable mbuf, which would trigger
assertion failures (see previous commit).

Sponsored by: Rubicon Communications, LLC ("Netgate")

[glebius]

sys/netpfil/pf/pf.c

8418–8423

Not insisting on this style, but I would write it down this way.

[kp]

sys/netpfil/pf/pf.c

8418–8423

I'll include the __predict_false, because that's just clearly better.

I'll also change it to set m at the same time. It doesn't break anything if it's not there because we do set it again with the pull-up later, but we should be consistent about it.

I don't like that one-line construct though. Perhaps your brain is just larger than mine.