Destroy machine when last principal unit removed.

This change causes a machine to be automatically removed when the last principal unit running on that machine is removed (remove-unit). If the machine is a parent to any containers, it is left alone.

Background:
https://bugs.launchpad.net/juju-core/+bug/1206532
https://bugs.launchpad.net/juju-core/+bug/1183309/comments/8

This could use more test coverage, but I'd like to get a general feel for how it's looking so far before I go much further with it. This is my first time mucking around with state transactions. Please let me know if I've got it right!

I haven't added an option to keep empty machines/containers around after removing the last unit. I'd like to see if we can avoid it. If we do need the option, I think it should be opt in. Let me know.
OK, I think I know what's bugging me. If we want to remove, it's easy, we have to pass all the remove assertions. But if we want to keep it, the ideal path is to generate assertions for *all* the keep cases, and just check that *any* of them will pass. So I think the ideal is to:

 1. figure out the value of remove in isolation, without building asserts
 2. if remove, build all remove asserts, and and them
 3. if keep, build all keep asserts, and or them

...but I could probably be convinced that yours if viable if you talk to me about it a bit.