pfdenied: fix checking root anchor

pfctl doesn't like empty anchors (-a ''), but we can specify the root
anchor as '/' too, so do that instead.

PR: 295324
Tested by: Paweł Krawczyk
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 3d9cd10b2857ee7a9ec1b04457d9ec44f614d32c)