Add support for scrub anchors and rules

[dlon]

Essentially, this PR adds scrub anchors (AnchorKind::Scrub), as well as scrub rules (ScrubRule), which may be added to such anchors. This is useful for evaluating rules only packet reassembly instead of evaluating them for each fragment.

Most options have not been included here. Extending the builder is non-breaking, so this should be fine.

Here is the result of running (some of) the examples (with irrelevant parts omitted):

$ ./target/debug/examples/add_anchor "test.anchor"
$ ./target/debug/examples/add_rules
$ pfctl -sr
...
scrub-anchor "test.anchor" all fragment reassemble
...
$ pfctl -sr -a test.anchor
...
scrub all fragment reassemble
...

---

This change is 

[faern]

https://www.youtube.com/watch?v=FrLequ6dUdM

Reviewed 13 of 13 files at r1, all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on @dlon)

---

CHANGELOG.md line 18 at r1 (raw file):

### Added
- Add support for scrub anchors and rules. Since this modifies public enums, it is a breaking
  change.

Please add that AnchorKind and RulesetKind is marked non_exhaustive to mitigate future breaking changes also.

---

tests/transaction.rs line 38 at r1 (raw file):

            .unwrap()
            .try_remove_anchor(anchor_name, pfctl::AnchorKind::Scrub)
            .unwrap();

Nit. But maybe place this last, so the order is the same everywhere.

[dlon]

:D

Reviewable status: 11 of 13 files reviewed, 1 unresolved discussion (waiting on @faern)

---

CHANGELOG.md line 18 at r1 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Please add that AnchorKind and RulesetKind is marked non_exhaustive to mitigate future breaking changes also.

Done!

---

tests/transaction.rs line 38 at r1 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Nit. But maybe place this last, so the order is the same everywhere.

Done. (Though I do prefer to remove filters in reverse order.)

[faern]

Reviewed 2 of 2 files at r3, all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved

---

tests/transaction.rs line 38 at r1 (raw file):

Previously, dlon (David Lönnhager) wrote…

Done. (Though I do prefer to remove filters in reverse order.)

Okay! Would be fine if it was fully reverse order IMO. But that would force you to move redirect removal to before filter removal also.