Migrate unit ports to machine port ranges

Upgrade step implemented to migrate ports from all unit
documents into port ranges on their assigned machine.
Because before we didn't have any validation for ports,
now during the migration it's guaranteed only valid and
non-conflicting port ranges are migrated.

Firewaller worker using APIV0 is removed, but the APIV0
itself will be dropped in a follow-up.

A few drive-by fixes for better user experience, logging,
and more tests added.