Update: Using wireshark I found that "browser.selfsupport.url" is indeed working. If leaving the default setting I can see connections to "shield-normandy-elb-prod-2099053585.us-west-2.elb.amazonaws.com". Leaving "browser.selfsupport.url" empty vanishes connections to amazonws.com.

So the question should be rephrased; how can I disable this keep-alive to [somestring].cloudfront.net?

All my tests are being done with disabled add-ons or executing firefox in safe mode.

Solution, two actions needed:

First change "network.tcp.keepalive.enabled" to false. This disabled the keep-alives to cloudfront.net.

After disabling this, I also noticed traffic to cloudfront.net once more. Every now and then a GET [string].cloudfront.net/success.txt. Apparently this traffic was also happening before, just couldn't see the difference, thought it was part of keep-alives. So,

Secondly change "network.captive-portal-service.enabled" to false.

As I can see now, opening Firefox with a blank page produces no traffic. I believe that that should be the default behaviour for a decent browser. Thanx Mozilla for the great browser and the ability to customize everything on it, but please keep it simple and low overhead by default.