Protect sbappendaddr() in divert_packet() with kernel lock. With

Protect sbappendaddr() in divert_packet() with kernel lock.  With
divert-packet rules pf calls directly from IP layer to protocol
layer.  As the former has only shared net lock, additional protection
against parallel access is needed.  Kernel lock is a temporary
workaround until the socket layer is MP safe.
discussed with kettenis@ mvs@