pf: minor fixes for pf_walk_header6()

• Fragment offset is in network byte order.
• Check for legal short fragments before calling pf_pull_hdr() to avoid bogus reason accounting.
• When checking wether the protocol header is within the fragment, count the IPv6 payload length relative to the end of the IPv6 header.

ok henning@

Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 3230e62590
Sponsored by: Rubicon Communications, LLC ("Netgate")