pf: reject hop-by-hop if it's not the first extension header

The pf fragment reassembly code accepted IPv6 hop-by-hop headers
after fragment headers. Add an extra check that the hop-by-hop
header is always the first extension header after the IPv6 header.
Found by Antonios Atlasis; OK sthen@ mpi@

Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 17ea4b2bcd
Sponsored by: Rubicon Communications, LLC ("Netgate")