feat: Add offline backend to firewall_lib

Add a new `firewall-offline-cmd` backend, which gets selected with the
new `online: false` module option (same as firewall_lib_facts). That
only supports `permanent` mode, not `runtime`.

This backend will be used during container builds.

Note: In principle this backend *could* be used for permanent+runtime as
well, if it does a service reload at the end. But there's still the
(pathological, but currently supported) "only runtime" case, so we need
the online backend anyway unless we want to deprecate runtime-only mode.

Author: martinpitt