pf: guard against DIOCADDRULE without DIOCXBEGIN

Possibility to do it was always a bug, but it runs into crashes
since recent introduction of a per-ruleset RB tree.

Reviewed by: kp
Sponsored by: Rubicon Communications, LLC ("Netgate")
Reported by: syzbot+665b700afc6f69f1766a@syzkaller.appspotmail.com