pf: fix if-bound with nat64

[kp]

Summary

Just as with reply-to rules we don't know what interface we will send this out
of until we create the state. Create new nat64 rules as floating, but bind them
to the appropriate interface on the first pf_route(), when we do know.

Set state policy if-bound for the nat64 tests to validate this.

See also: 6460322a0
Sponsored by: Rubicon Communications, LLC ("Netgate")