net80211: sanitize input for ieee80211_output()

• Add some basic checks for i_fc* bits (ToDS, FromDS, MoreFrag, Protected);

those are used / checked across various places in Tx path.

• Mark injected 802.11 frame as encapsulated (just as it should be).
• Classify 802.11 frame in a proper way (extract ether_type from LLC header

for Data frames, use AC_BE queue for others (NoData / Management / Control).

• Subtract header length from tx_bytes statistics (so it will correspond

to the comment).

Was checked with RTL8188EU (AP) + Intel 6205 (STA).

Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D13161