FirewallerAPIV1 implemented; tests improved

This is part 2/4 in the port ranges support work: changes
to the firewaller API to enabled watching opened ports on
machines and not units.

Changes in FirewallerAPI V1:
 - Added WatchOpenedPorts(environTag) method. Environment tag
   is currently ignored internally, but required for future
   compatibility.
 - Added GetMachinePorts() and apifirewaller.Machine.OpenedPorts().
   It returns all opened ports for a given machine on a given
   network (currently, until multiple networks are supported,
   the default public network is hard-coded in a few places).
 - Added GetMachineActiveNetworks() and apifirewaller.Machine.
   ActiveNetworks(). It returns a list of networks the machine
   has opened ports on.
 - Watch() method no longer allows unit tags, as the firewaller
   won't need to watch units anymore.
 - OpenedPorts() and apifirewaller.Unit.OpenedPorts() removed.

Refactored both the apiserver/firewaller and api/firewaller to
test API versions as needed, and minimized duplicated code/tests.

Also, during testing I found out the openedPortsWatcher does
not behave as expected and was fixed.

Right now, the firewaller worker still uses FirewallerAPIV0, and
it will be changed to use the new version in the next follow-up.

Later, there will be a few more steps to complete the port
ranges support: firewaller worker to use the new API, an
upgrade step to migrate unit ports to machine ports, cleaning
up all legacy support code and other improvements, making
"open-port" and "close-port" hook tools accept port ranges,
and finally adding a new "opened-ports" hook tool to list
ports.