pf: fix ICMP source address translation for nat64

[kp]

Summary

While handling an ICMP error related to another state (e.g. TTL expired, port
closed, fragmentation needed, ...) we can't just use the state's source address
as the ICMP source address. We have to translate the IPv4 address back to an
IPv6 nat64 address.

Failing to do so breaks things like traceroute, where the intermediate router
generates an ICMP error message, and the traceroute tool uses the source address
to build the path.

PR: 284944
Sponsored by: Rubicon Communications, LLC ("Netgate")

[kp]

Use the approach from OpenBSD's proposed patch.
That's a bit simpler and still works.

[kp]

Update to the committed OpenBSD version of this fix.