pfsync: locking fixes

• Ensure we unlock the pfsync lock in pfsync_defer()
• We must hold the bucket lock when calling pfsync_push()
• The pfsync_defer_tmo() callout locks the bucket lock, not the pfsync lock

Reviewed by: glebius
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D33243

(cherry picked from commit 41c4f1987243cefe81adcc31d5401e7a80a0428c)