pf: invert direction for inner icmp state lookups

(e.g. traceroute with icmp)
ok henning, jsing

Also extend the test case to cover this scenario.

Approved by: so
Security: FreeBSD-EN-24:16.pf
PR: 280701
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 89f6723288b0d27d3f14f93e6e83f672fa2b8aca)
(cherry picked from commit 46c4fc50d3012ca3c8756df243589add36b70830)