When IPSEC is configured according to the Handbook[1], pf fails
to track connection state properly, because it does not see
packets coming from the tunneled interface to gif(4). Rebuilding
with IPSEC_FILTERGIF fixes the problem.

According to mlaier@ we cannot change GENERIC for this, but it's
ok to document the requirement for IPSEC_FILTERGIF. Add a note
to this effect.

[1] http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html

PR: kern/97057
Submitted by: Dmitry Andrianov <freebsd@dima.spb.ru>
Suggested by: mlaier
Reviewed by: remko