Description of problem:
Via rich rules, one can use for example

1. firewall-cmd --permanent --zone=XXX --add-rich-rule='rule family="ipv4" source address=192.168.4.0/24 service name=all log prefix="IN_BOUND_XXX " level="info" limit value="2/d" accept'
   Once bz2181406 is implemented, that will create nft like the following command work create:
2. nft add rule inet firewalld filter_IN_public_log ip saddr 192.168.4.0/24 \
   tcp dport 22 ct state { new, untracked } \
   limit rate 2/day log prefix "IN_BOUND_XXXX " level info
   
   The issue is that firewall-cmd does not handle the nft "burst" option. Above will assume "burst 5 packets", but to set the limit of 2/day, we would need firewall-cmd to handle burst, so it creates a rule like this:
   # nft add rule inet firewalld filter_IN_public_log ip saddr 192.168.4.0/24 \
   tcp dport 22 ct state { new, untracked }

   \
   limit rate 2/day burst 1 packets log prefix "IN_BOUND_XXXX " level info

firewall-cmd might instead of the nft utility use a different interface.

Version-Release number of selected component (if applicable):
all

How reproducible:
always

Expected outcome:
firewall-cmd should be extended to create nft rules which allow setting of burst, i.e. "burst 1 packets".