Merge r261882, r261898, r261937, r262760, r262799:

Merge r261882, r261898, r261937, r262760, r262799:
  Once pf became not covered by a single mutex, many counters in it became
  race prone. Some just gather statistics, but some are later used in
  different calculations.

  A real problem was the race provoked underflow of the states_cur counter
  on a rule. Once it goes below zero, it wraps to UINT32_MAX. Later this
  value is used in pf_state_expires() and any state created by this rule
  is immediately expired.

  Thus, make fields states_cur, states_tot and src_nodes of struct
  pf_rule be counter(9)s.

git-svn-id: svn://svn.freebsd.org/base/stable/10@263029 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f