Add bootstrap flag to allow failed bootstraps to keep the environment

Fixes: https://bugs.launchpad.net/juju-core/+bug/1362923

bootstrap now has a keep-broken flag which tells it not to cleanup after a failed bootstrap
There may not even be a bootstrap instance. I'd reword to say something along the lines of "so environment is not being destroyed."

`juju destroy-environment --force` takes care of it all. I think it'd be clearer just to direct users to use that, rather 
than an "also". Perhaps something like: When you are finished diagnosing the problem, run "juju destroy-environment --force <env>" to clean up the environment.