Firewaller using APIV1 when available, otherwise uses APIV0 and legacy code

Next step of supporting port ranges for charms. Renamed the
current (legacy) firewaller code to FirewallerV0, and its
tests as well moved in separate files with _v0 suffix (so it's
easier to drop them althogether).
We'll keep this legacy code for backwards compatibility
until there's an upgrade step in place that properly migrates
unit ports to machine+network port ranges in the DB.
Firewaller worker now uses API V1 if available, or falls back
to V0 transparently.
A few fixes were needed for the OpenedPortsWatcher again.
I was concerned about this, but since we're already leaking out entities' IDs with all API watchers, introducing a tag or something just in this one might be a bad idea. Do you suggest to use "ports-machine-0-network-juju-public" as a tag or you'd rather have a custom watcher with Changes{MachineId, NetworkName string} instead of a StringsWatcher?
In any case, I prefer if any such change is done in a follow-up please.