pfctl: Allow TOS bits to be cleared

TOS value 0 is valid, so use 256 as an invalid value rather than zero.
This allows users to enforce TOS == 0 with pf.

Reported by: Radek Krejča <radek.krejca@starnet.cz>