Shut-off direct database access

No longer expose port 37017 on machines, as direct mongo access is no longer required.

This is a repeat of PR 449 (effectively a revert of the revert).

https://github.com/juju/juju/pull/449/

This was reverted because restore still used direct state access. Once PR 561 has been merged direct DB access can be shutoff (again).

https://github.com/juju/juju/pull/561/
So where we test that perms HasLen 5, we are explicitly checking that only the ports we expect are open. This does test that the StatePort is not open.