Fix off-by-one error in per-rule state limit. Allow creation of as many states
as the "max" state option.
Check per-rule state count against maximum before calling pf_create_state().
This saves us one function call and brings the code slightly closer to OpenBSD.