pf: fix address range handling in pfr_pool_get()

We did not fill out the address in uaddr before running the rn_match() lookup.
Change addr to a pointer into uaddr so that we do.

Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D48083