support negation in portspec

When using the "services" command to get an overview over all services currently in the database, I found it useful to be able to exclude certain ports.