MFC r336275:

pf: Fix synproxy

Synproxy was accidentally broken by r335569. The 'return (action)' must be
executed for every non-PF_PASS result, but the error packet (TCP RST or ICMP
error) should only be sent if the packet was dropped (i.e. PF_DROP) and the
return flag is set.

PR: 229477
Submitted by: Andre Albsmeier <mail AT fbsd.e4m.org>