Fragments for a single connection (a combination of proto,src,dst,af)

Fragments for a single connection (a combination of proto,src,dst,af)
may easily reuse the fragment id as it is only 16 bit for IPv4.  To
avoid that pf reassembles them into the wrong packet, throw away
stale fragments.  With the default timeout this happens after 12,000
newer fragements have been seen.
from markus@; OK sashan@