ipfw: Have NAT steal the TH_RES1 bit, instead of the TH_AE bit

The NAT module use of the tcphdr.th_x2 field now collides with the
use of this TCP header flag as AccECN (AE) bit. Use the topmost
bit instead to allow negotiation of AccECN across a NAT device.

Event: IETF 115 Hackathon
Reviewed By: transport, tuexen
MFC after: 3 days
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D37300