new pflog


so now pflog logs correctly again
committed from the j2k10 hackathon in japan

without making stupid extra copies
and without screwing the live mbuf

and in the new, extended header, we copy out the old addresses before NAT
and tcpdump can display them