pf tests: test IPv6 fragmentation with link-local addresses

We've observed a panic after pf_refragment6() with link-local addresses,
because pf_refragment6() calls ip6_forward() even for a simple output
case.
That results in us entering ip6_forward() with an mbuf with a NULL
m->m_pkthdr.rcvif, which can cause a NULL deref (but seemingly not for
GUAs.

Test sending fragmented link-local packets to pf.

MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D39063

(cherry picked from commit 225e85513fd7a5e31f649e35f0b99454bb725776)