MFC: 1.158 - 1.161

Block packets with a 127/8 destination arriving via an exernal interface.

Disable IP address vs. arrival interface consistency checking for unicast
packets when IP forwarding is enabled and for packets forwarded by 'ipfw fwd'.

Always perform broadcast IP address vs. arrival interface checking. This
was the historical behavior, but has been broken for quite a while.

Attempt to optimize the order of the tests.

Also, disable unicast IP address vs. arrival interface checking by default
for POLA reasons.

Approved by: jkh