pf: exclude link local address from the dynamic interface address pool

so that rules like "pass out on vr1 inet6 nat-to (vr1)" won't map
to the non routable ipv6 link local address; with suggestions and
ok claudio, henning

Reviewed by: zlei
Obtained from: OpenBSD, mikeb <mikeb@openbsd.org>, e41548933f
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D46594