pfdenied: fix checking root anchor

pfctl doesn't like empty anchors (-a ''), but we can specify the root
anchor as '/' too, so do that instead.

PR: 295324
Tested by: Paweł Krawczyk
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")