vlanfilter was originally a per-interface flag to allow more flexible
configurations where some interfaces had VLAN filtering enabled and
some didn't. In practice, this just makes the configuration more
confusing without any real benefit.
Rename the defvlanfilter bridge flag to vlanfilter, make it enable
filtering unconditionally, and remove the vlanfilter interface flag.
Remove the magic that enabled VLAN filtering automatically when setting
filtering parameters on an interface, since it's now a one-time setting.
Instead, to avoid misconfiguration, don't allow PVID or VLAN access list
to be configured on an interface unless vlanfilter is enabled on the
bridge itself.
While here, add some more atf_checks to the bridge VLAN tests to
make debugging easier.