state: use a raw transaction in SetAgentVersion

This method may get called before DB migration has run so automatic
addition of env UUID is a bad idea.

Part of the fix for LP #1403738.
cmd/jujud: introduce api-post-upgrade worker

This worker runs all other workers that need to be started after
upgrades have finished. The main benefit is that it stops container
setup from running during upgrades, but it also makes the code more
readable and avoids many startWorkerAfterUpgrade calls.

Part of the fix for LP #1403738.
Merge pull request #1343 from mjs/1403738-fix-upgrades

Upgrade fixes for LP #1403738

Two separate fixes here. 

The first changes SetAgentVersion to use a raw transaction as it is called before upgrade steps have run.

The second ensures that container setup in the machine agent is done _after_ upgrades are complete. This involves some reorganisation of the API workers that need to start after upgrades are complete.

(Review request: http://reviews.vapour.ws/r/664/)
Do not restart api server when a new server certifiate is made, simply replace the cert
A little cleanup
Use tomb for cert changed listener
Fix test
Close cert changed channel when cert update workr exits
Fix cert update channel deadlock
Use pointer for listener
Merge pull request #1346 from wallyworld/prevent-apiserver-restart

Do not restart api server when a new server certifiate is made, simply replace the cert

When machine addresses are updated, a new server certificate is made so that connections over those addresses can be made securely. Instead of restarting the API server to use the new certificate, the net listener is modified to replace the current certificate with the new one without stopping and starting the server. While the certificate is being updated, new connections to the server are disallowed.

(Review request: http://reviews.vapour.ws/r/667/)