Free counters after the other things as we still update them during
teardown; this avoids memory modified after free panics.

Add missing locks around a few places to avoid race conditions.

Set some cached 'kif' values to NULL before freeing it so we will
not try to access freed memory anymore.

Add V_pf_vnet_active in addition to hooked and running to indicate
the state of the VNET. We need a dedicated flag mostly for external
events.

Add various checks for kif being valid, and V_pf_vnet_active being
true on global external events to avoid running code for VNETs
shutting down.

Having some simple ruleset with state and a hundred or so connections
this seems getting stable now.

Sponsored by: The FreeBSD Foundation