Ports document now used to store opened ports for machine/network tuple.

This patch is the beginning of a solution for #1216644 . 

To implement this, a new openedPorts collection is introduced, with a ports document for each machine and network (only the "juju-public" network is supported at the moment).

Any existing port entries in the unit document are migrated to the ports document. New ports are still appended to the ports list in the unit document - this functionality will be removed when the firewaller is updated to watch the openedPorts collection.
Shouldn't you add Assert: txn.DocExists in this op? You're checking if it's still there when you retry.