ipfilter: Move kernel bits to netpfil

Through fixes and improvements our ipfilter sources have diverged
enough to warrant move from contrib into sys/netpil. Now that I'm
planning on implementing MSS clamping as in iptables it makes more
sense to move ipfilter to netpfil.

This is the first of three commits the ipfilter move.

Suggested by glebius on two occaions.

Suggested by and discussed with: glebius
Reviewed by: glebius, kp (for network)
Differential Revision: https://reviews.freebsd.org/D33510

(cherry picked from commit 3b9b51fe464ebb91e894742a6a0e6417e256f03a)