ipfilter: Move userland bits to sbin

Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sbin/ipf. Now that I'm
planning on implementing MSS clamping as in iptables it makes more
sense to move ipfilter to sbin.

This is the second of three commits of the ipfilter move.

Suggested by glebius on two occaions.

Suggested by and discussed with: glebius
Reviewed by: glebius, kp (for network)
Differential Revision: https://reviews.freebsd.org/D33510

(cherry picked from commit 41edb306f05651fcaf6c74f9e3557f59f80292e1)