pf: fix dummynet + route-to for IPv6

Apply the fixes from c6f1116357904 and b8ef285f6cc6a to IPv6 as well.

Ensure that when dummynet re-injects it does so in the correct direction, and
uses the correct dummynet pipes.

Sponsored by: Rubicon Communications, LLC ("Netgate")