Destroy machine when last principal unit removed.

This change causes a machine to be automatically removed when the last principal unit running on that machine is removed (remove-unit). If the machine is a parent to any containers, it is left alone.

Background:
https://bugs.launchpad.net/juju-core/+bug/1206532
https://bugs.launchpad.net/juju-core/+bug/1183309/comments/8

This could use more test coverage, but I'd like to get a general feel for how it's looking so far before I go much further with it. This is my first time mucking around with state transactions. Please let me know if I've got it right!

I haven't added an option to keep empty machines/containers around after removing the last unit. I'd like to see if we can avoid it. If we do need the option, I think it should be opt in. Let me know.
We definitely need more tests here:

  * each of the can't-destroy-machine conditions
  * at least a representative sample of TransactionHooks tests that force txn rebuilds to deal with changing conditions
  * a deliberately pathological TransactionHooks test that keeps on changing state until the outer loop gives up and returns ErrExcessiveContention

...and really we ought to cover all of these cases with both a unit that fast-forwards to removal from Destroy *and* one that's done directly with Remove, (set this up with preventUnitDestroyRemove, Destroy, EnsureDead, before calling Remove).