Render, but don't apply, rules - for debugging

[jcpunk]

What would you like to be added

A switch to firewall-cmd/firewall-offline-cmd to print out the actual nftables/iptables rules that would be applied - but don't actually apply them.

Why is this needed

I've got a fairly ugly mash of zones, policies, rich rules, and ipsets. Somewhere along the line I messed up and locked myself out of the box. I can't see what I did wrong in the firewalld configs. When I load them so that the rules are active, I'm locked out. Having a clean way to look at what would be applied, but not actually apply them would drastically simplify my troubleshooting.