vnic: apply BPF tap before passing packet to hardware

Previously we passed tx packets to hardware via nicvf_tx_mbuf_locked
and then to the BPF tap, with a possibly invalid mbuf which would result
in a panic.

PR: 223600
Discussed with: bz
MFC after: 1 week
Sponsored by: The FreeBSD Foundation, Packet.net (hardware)