pf: fix securelevel off-by-one

cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.

PR: 296838
MFC after: 4 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D58377

(cherry picked from commit d13dffa150d17dc239e164ea42ddab91e6fab466)