pf: invert direction for inner icmp state lookups

(e.g. traceroute with icmp)
ok henning, jsing

Also extend the test case to cover this scenario.

PR: 280701
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")