congestion indicator in stack and pf


major goal was to leave enough CPU time so that an admin can log in on the console and cope by changing ruleset or the like
in our tests, that was easily reached
in fact, we even did that over an established ssh session without even noticing :)

different values for the timer to clear the flag didn't have much effect
so we used the shortest possible, one tick
if there is still congestion, the flag will just be set again almost immediately