pf: verify SCTP v_tag before updating connection state

Make it harder to manipulate the firewall state by verifying the v tag before we
update states.

MFC after: 2 weeks
Sponsored by: Orange Business Services