Restrict 520.pfdenied to only list rules that blocked traffic.
Before this change, the 520.pfdenied script listed all rules that
matched /^block/ in the rule. Restrict the printed output to only
those rules that result in packets being dropped.

PR: conf/187224
Approved by: rpaulo (mentor)
Differential Revision: https://reviews.freebsd.org/D4068