firewall: Add diagnostics for expected config from setup
Add diagnostic checks for:
- default zone = external
- backend = nftables
- there are at least 12 direct passthroughs
I checked that each one could fail, by manually changing the firewalld configuration, or removing a passthrough.
Signed-off-by: James Valleroy jvalleroy@mailbox.org