pf: Handle (*m0)->m_len < sizeof(struct ip) case

if_enc(4) can pass IPsec payload to pfil(9) with the outer header or without
it. In case of a small packet like ICMP, when mbuf cluster is not used,
everything works fine. Otherwise, the first mbuf in a chain has m_len == 0
if it is asked to strip the outer header. pf was not handling such case, and
erroneous reading of the outer IP header led to unexpected behavior.

Reviewed by: kp, glebius
Differential Revision: https://reviews.freebsd.org/D45780