pf: Return non-zero from 'status' if pf is not enabled

In the pf rc.d script the output of /etc/rc.d/pf status or `/etc/rc.d/pf
onestatus` always provided an exit status of zero. This made it fiddly to
programmatically determine if pf was running or not.

Return a non-zero status if the pf module is not loaded, extend pfctl to have
an option to return an error status if pf is not enabled.

PR: 228632
Submitted by: James Park-Watt <jimmypw AT gmail.com>
MFC after: 1 week