pf: ignore/preserve ECN bits on ToS matching and scrubbing

The lower 2 bits of the tos-header are used for ECN.
(http://tools.ietf.org/html/rfc2474#section-3)
OK henning@, haesbaert@

Obtained from: OpenBSD, mpf <mpf@openbsd.org>, 60dfe711ee
Sponsored by: Rubicon Communications, LLC ("Netgate")