tcp: improve MAC error handling for SYN segments

Don't leak a maclabel when SYN segments are processed which results
in an error due to MD5 signature handling.
Tweak the #idef MAC to allow additional upcoming changes.

Reviewed by: markj
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D46766

(cherry picked from commit 78e1b031d2e8ef0e1cbc8874891f5476dc7868bc)