firewalld: Only unmask the service if necessary
firewalld: Add tags