Allow build on PF-less (NO_IPSET) systems.

This adds a new ports option, IPSET, defaulting to on.

Use the opportunity to use the options helpers OPT_CFLAGS[_OFF] on the
trivial options.

PR: 217900
Submitted by: Oliver Pinter <oliver.pinter@hardenedbsd.org>