pf: invert direction for inner icmp state lookups

(e.g. traceroute with icmp)
ok henning, jsing

Also extend the test case to cover this scenario.

PR: 280701
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 89f6723288b0d27d3f14f93e6e83f672fa2b8aca)