pf: Don't access sk and nk before they are allocated

[vegeta_tuxpowered.net]

Summary

The NAT addresses are chosen during ruleset parsing. The new af-to code stores
post-nat addresses in nsaddr. The old nat code (also used for new nat-to rules)
creates state keys and stores addresses in them.

Ensure proper way of accessing the NAT addresses in case sticky-address
is used for af-to rules.

[kp]

Approved.