ipfw: Have NAT steal the TH_RES1 bit, instead of the TH_AE bit

The NAT module use of the tcphdr.th_x2 field now collides with the
use of this TCP header flag as AccECN (AE) bit. Use the topmost
bit instead to allow negotiation of AccECN across a NAT device.

Event: IETF 115 Hackathon
Reviewed By: transport, tuexen
MFC after: 3 days
Approved by: re (gjb, early-MFC)
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D37300

(cherry picked from commit 0b00b801493aa1d4996b0891ea58fbef343f85df)