ipfw: forbid add keep-state rules that depend from tablearg

[ae]

Summary

tablearg is determined after making table lookup. When we applying
rule action that uses dynamic state, such lookup was not done and
thus action can not determine what table and what value should be used.
Instead we check such rules when they are added and return error.