pf: invert direction for inner icmp state lookups

(e.g. traceroute with icmp)
ok henning, jsing

Also extend the test case to cover this scenario.

PR: 280701
Approved by: re (cperciva)
Obtained from: OpenBSD
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 89f6723288b0d27d3f14f93e6e83f672fa2b8aca)
(cherry picked from commit 5f3f07397a7909e8f9449d1aa0b465159cbf0d60)