It is recommended that cni-plugins create a new space when using firewalld as the backend instead of using the trusted space directly

[unknowndevQwQ]

Both docker's libnetwork and containers/netavark create their own ZONE to avoid using trusted ZONE, but cni-plugins doesn't do this. It didn't affect me for a while when I discovered that cni-plugins had this behavior, but when I tried to monitor the network behavior of containers in podman, I found that I had some interfaces that really needed the trusted ZONE interface to use trusted ZONE with the containers, so I had to move those interfaces to other ZONEs to avoid confusing the two