pf synflood mode: SYN


if in synflood mode, steal SYN early in pf_test()

answer SYNs with a syncookie-SYNACK

answer every SYN unconditionally
don't even consult the ruleset, expensive