pf: send a challenge ACK for SYN's matching existing states

PF should send a challenge ACK as response to SYN, which matches existing
state. Extra thanks goes to bluhm@ for careful testing and fixing patch I've
sent to tech@

O.K. henning@ bluhm@

Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 6679bb1581
Sponsored by: Rubicon Communications, LLC ("Netgate")