npf: nbuf_ensure_contig and large options

[Maxime Villard <max%m00nbsd.net@localhost>]

For the record, an issue I spotted some time ago; nbuf_ensure_contig calls
m_ensure_contig with the first mbuf of the chain, but m_ensure_contig has
a maximum 'len' argument of MHLEN, which is below the allowed option offset
for IPv6. So if you send a big IPv6 packet, and if an option happens to be
split across two mbufs, NPF fails to parse the packet.

There probably aren't many reasons for an IPv6 packet to have an option
located this far, but that's theoretically possible, and more importantly,
correct specwise.

NPF needs to be able to do an ensure_contig on secondary mbufs, without
moving everything into the first one. Not sure how to achieve this, I will
probably just file a PR.