pf: allow 'allow-opts' to be used on match rules

Allow the 'allow-opts' setting to be set on match rules.
The intended use case is to simplify dealing with traffic where IP options are
expected (e.g. IGMP), without allowing them on other traffic, or making the
ruleset more complex.

Add a test case confirming this works as expected.

Sponsored by: Rubicon Communications, LLC ("Netgate")