pf: ensure mbufs are writable

Ensure that we can modify mbufs before we start processing them. There are a
number of paths where pf will m_copyback() or otherwise modify a packet. Ensure
that this is safe to do.

For example, ip6_forward() will m_copym() the packet before handing it to the
output pfil hook. This results in a non-writable mbuf, which would trigger
assertion failures (see previous commit).

Reviewed by: glebius (previous version)
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46628