pfctl: use pfctl_add_rule_h() rather than pfctl_add_rule()

This ensures we use the handle opened with pfctl_open(), and also brings
us closer to the ideal state where everything uses the handle rather
than a file descriptor.