Use m_catpkt(9) to avoid a possible use-after-free in ieee80211_defrag().

m is not guaranteed to be valid after m_cat() returns. The effects of this
are most noticeable when INVARIANTS is enabled, since m's header length
field is given a value of 0xdeadc0de by the trash dtor.

Reviewed by: glebius
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D5497