pf sends outbound packets by offloading them to a single per-vnet SWI handler
through the V_pf_sendqueue mbuf queue. A large DDoS attack may overwhelm
that per-vnet queue with syncookie packets and cause contention in the SWI
handler that negatively affects other pf operations.
Fix this by sending the initial syncookie challenge from the context
of the receiving thread. This avoids the syncookie-induced contention on
the pf_intr mbuf queue.
Sponsored by: Klara, Inc.
Sponsored by: Entersekt
MFC after: 3 weeks
