pf: improve add state validation

Both for the DIOCADDSTATE ioctl and for states imported through pfsync packets.
Add a test case to exercise this code path.

Approved by: re (cperciva)
Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit faacc0d968816cf8714c974b6d8df6191cfb0e0d)
(cherry picked from commit 4891e6f1c0ee9d81ca36b9d74d8ef4ef20690621)